ColdFusion User-Agent cross-site scripting

  • Input passed to the "User-Agent" header parameter it isn't properly sanitised before being returned to the user on 404 or 500 error. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. <br/> <br/> <span class="bb-navy">Confirmed in version MX 7. Other versions may also be affected.</span>
  • Contact the vendor for further information.