CVE-2017-11286

High

Published: 01/12/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Adobe ColdFusion has an XML external entity (XXE) injection vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.

Risk Assessment

Exploitation of this vulnerability may lead to the disclosure of sensitive data or attacks on systems processing malicious XML data.

Recommendation

It is recommended to upgrade to the latest version of ColdFusion to mitigate this vulnerability.

Other vulnerabilities in Adobe ColdFusion 2016 (Update 4 and earlier), Adobe ColdFusion 11 (Update 12 and earlier)

CVE-2017-11283Critical
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.

Original NVD description (English source)

Adobe ColdFusion has an XML external entity (XXE) injection vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.