Cross-Site Scripting in ColdFusion in ColdFusion - CVE-2016-4159
Published: June 17, 2016 / Updated: February 3, 2026
Vulnerability details
A cross-site scripting vulnerability was reported in ColdFusion.
The vulnerability exists due to insufficient sanitization of input data. A remote attacker can send a specially crafted HTTP request to the vulnerable application and execute arbitrary HTML and script code in user’s browser in security context of vulnerable website.
Exploitation of this vulnerability may allow an attacker to obtain sensitive to the victim information, such as cookies, or disguise website content.
Affected software
How to mitigate CVE-2016-4159
The vulnerability is fixed in the following versions of ColdFusion:
- ColdFusion (2016 release) Update 2
- ColdFusion 11 Update 9
- ColdFusion 10 Update 20
Adobe recommends ColdFusion customers update their installation using the instructions provided in the relevant technote:
- ColdFusion (2016 release): http://helpx.adobe.com/coldfusion/kb/coldfusion-2016-update-2.html
- ColdFusion 11: http://helpx.adobe.com/coldfusion/kb/coldfusion-11-update-9.html
- ColdFusion 10: http://helpx.adobe.com/coldfusion/kb/coldfusion-10-update-20.html
Customers should also apply the security configuration settings as outlined on the ColdFusion Security page as well as review the respective Lockdown guide.