CVE-2013-3350

EUVD-2013-3286
Adobe ColdFusion 10 before Update 11 allows remote attackers to call ColdFusion Components (CFC) public methods via WebSockets.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
10 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:C/I:C/A:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 81%
Affected Products (NVD)
VendorProductVersion
adobecoldfusion
10.0
adobecoldfusion
10.0:update1
adobecoldfusion
10.0:update2
adobecoldfusion
10.0:update3
adobecoldfusion
10.0:update4
adobecoldfusion
10.0:update8
𝑥
= Vulnerable software versions
References
http://stackoverflow.com/questions/17351214/cf10-websocket-p2p-can-invoke-any-public-functions-in-any-cfc-from-javascript-h
http://www.adobe.com/support/security/bulletins/apsb13-19.html
http://www.securitytracker.com/id/1028757
http://stackoverflow.com/questions/17351214/cf10-websocket-p2p-can-invoke-any-public-functions-in-any-cfc-from-javascript-h
http://www.adobe.com/support/security/bulletins/apsb13-19.html
http://www.securitytracker.com/id/1028757