Bugtraq ID: 14460 : Coldfusion Fusebox V4.1.0 Vulnerability
From: Adrocknaphobia (adrocknaphobia_at_gmail.com)
Date: 08/09/05
- Previous message: heintz_at_hotmail.com: "Sql injection and global variables poisoning in XMB Forum 1.9.1"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 9 Aug 2005 12:44:28 -0400 To: bugtraq@securityfocus.com
The following vulnerability is inaccurate. Fusebox is a framework
popular with ColdFusion developers. The cross-site scripting
vulnerability is not specific to the framework, and is clearly an
implementation issue.
Fusebox, as a framework, does not output any URL parameters to HTML.
The output is controled by the application developer. FuseBox does not
even have to generate HTML for that matter.
Within the fusebox framework, a layout configuration file is used to
generate output. The layout file is completely coded by the
application developer. The official FuseBox v4.1.0 core files do not
contain _any_ layout configuration files.
Bugtraq ID: 14460
Class: Input Validation Error
CVE: CVE-MAP-NOMATCH
Remote: Yes
Local: No
Published: Aug 03 2005 12:00AM
Updated: Aug 03 2005 03:24PM
Credit: "N.N.P" is credited with the discovery of this vulnerability.
Vulnerable: Fusebox Fusebox 4.1 .0
- Previous message: heintz_at_hotmail.com: "Sql injection and global variables poisoning in XMB Forum 1.9.1"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
