RCE in Adobe Coldfusion

CVE-2012-2041

CRLF injection vulnerability in the Component Browser in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.019 (77.1th percentile) — read the EPSS interpretation.

Affected products

Adobe Coldfusion — versions 8.0, 8.0.1, 9.0
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

psirt@adobe.com (x_refsource_CONFIRM, Patch, Vendor Advisory)