ColdFusion User-Agent cross-site scripting

  • Input passed to the "User-Agent" header parameter it isn't properly sanitised before being returned to the user on 404 or 500 error. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

    Confirmed in version MX 7. Other versions may also be affected.
  • Contact the vendor for further information.