漏洞描述
Adobe ColdFusion Server 8.0.1 and earlier contain multiple cross-site scripting vulnerabilities which allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2) wizards/common/_logintowizard.cfm, (3) wizards/common/_authenticatewizarduser.cfm, or (4) administrator/enter.cfm.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
www.tenable.comhttps://www.tenable.com/cve/CVE-2009-1872↗www.adobe.comhttp://www.adobe.com/support/security/bulletins/apsb09-12.html↗www.dsecrg.comhttp://www.dsecrg.com/pages/vul/show.php?id=122↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2009-1872↗github.comhttps://github.com/ARPSyndicate/kenzer-templates↗