Vulnerability CVE-2016-4264

Vulnerability Name:

CVE-2016-4264 (CCN-116400)

Assigned:

2016-08-30

Published:

2016-08-30

Updated:

2020-09-04

Summary:

The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVSS v3 Severity:

8.6 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
7.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

4.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-611

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2016-4264

Source: MISC
Type: Exploit, Third Party Advisory
http://legalhackers.com/advisories/Adobe-ColdFusion-11-XXE-Exploit-CVE-2016-4264.txt

Source: BUGTRAQ
Type: UNKNOWN
20160907 CVE-2016-4264 Adobe ColdFusion <= 11 XXE Vulnerability

Source: BID
Type: UNKNOWN
92684

Source: CCN
Type: BID-92684
Adobe ColdFusion CVE-2016-4264 XML External Entity Information Disclosure Vulnerability

Source: SECTRACK
Type: UNKNOWN
1036708

Source: XF
Type: UNKNOWN
adobe-coldfusion-cve20164264-info-disc(116400)

Source: CCN
Type: Adobe Security Bulletin APSB16-30
Security Update: Hotfixes available for ColdFusion

Source: CONFIRM
Type: Vendor Advisory
https://helpx.adobe.com/security/products/coldfusion/apsb16-30.html

Source: CCN
Type: Packet Storm Security [09-07-2016]
Adobe ColdFusion 11 XML External Entity Injection

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [09-08-2016]

Source: EXPLOIT-DB
Type: UNKNOWN
40346

Vulnerable Configuration:

Configuration 1:

cpe:/a:adobe:coldfusion:*:update21:*:*:*:*:*:* (Version <= 10.0)

OR cpe:/a:adobe:coldfusion:*:update10:*:*:*:*:*:* (Version <= 11.0)

Denotes that component is vulnerable

BACK