Read the docs
TI-2017-02228 Aliases CVE-2017-3008GHSA-9h7c-rhx9-8hq9

Cross-site scripting in Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion…

Priority LOW 33CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a reflected cross-site scripting vulnerability.

Why it matters now

EPSS 0.03069 87th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlierAdobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier—No fix listedCNA
  • Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier Vendor— Affected Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier Fixed in — No fix listed CNA

CPE configurations NVD · 39

CPEVersionsRoleVendor
cpe:2.3:a:adobe:coldfusion:10.0:-:*:*:*:*:*:*10.0VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update1:*:*:*:*:*:*10.0 update1VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update10:*:*:*:*:*:*10.0 update10VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update11:*:*:*:*:*:*10.0 update11VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update12:*:*:*:*:*:*10.0 update12VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update13:*:*:*:*:*:*10.0 update13VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update14:*:*:*:*:*:*10.0 update14VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update15:*:*:*:*:*:*10.0 update15VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update16:*:*:*:*:*:*10.0 update16VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update17:*:*:*:*:*:*10.0 update17VulnerableAdobe
  • cpe:2.3:a:adobe:coldfusion:10.0:-:*:*:*:*:*:* Versions 10.0 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update1:*:*:*:*:*:* Versions 10.0 update1 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update10:*:*:*:*:*:* Versions 10.0 update10 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update11:*:*:*:*:*:* Versions 10.0 update11 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update12:*:*:*:*:*:* Versions 10.0 update12 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update13:*:*:*:*:*:* Versions 10.0 update13 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update14:*:*:*:*:*:* Versions 10.0 update14 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update15:*:*:*:*:*:* Versions 10.0 update15 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update16:*:*:*:*:*:* Versions 10.0 update16 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update17:*:*:*:*:*:* Versions 10.0 update17 Vulnerable ·Adobe
Show 29 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:adobe:coldfusion:10.0:update18:*:*:*:*:*:*10.0 update18VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update19:*:*:*:*:*:*10.0 update19VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update2:*:*:*:*:*:*10.0 update2VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update20:*:*:*:*:*:*10.0 update20VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update21:*:*:*:*:*:*10.0 update21VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update22:*:*:*:*:*:*10.0 update22VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update3:*:*:*:*:*:*10.0 update3VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update4:*:*:*:*:*:*10.0 update4VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update5:*:*:*:*:*:*10.0 update5VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update6:*:*:*:*:*:*10.0 update6VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update7:*:*:*:*:*:*10.0 update7VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update8:*:*:*:*:*:*10.0 update8VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:10.0:update9:*:*:*:*:*:*10.0 update9VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:-:*:*:*:*:*:*11.0VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update1:*:*:*:*:*:*11.0 update1VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update10:*:*:*:*:*:*11.0 update10VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update11:*:*:*:*:*:*11.0 update11VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update2:*:*:*:*:*:*11.0 update2VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update3:*:*:*:*:*:*11.0 update3VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update4:*:*:*:*:*:*11.0 update4VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update5:*:*:*:*:*:*11.0 update5VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update6:*:*:*:*:*:*11.0 update6VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update7:*:*:*:*:*:*11.0 update7VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update8:*:*:*:*:*:*11.0 update8VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:11.0:update9:*:*:*:*:*:*11.0 update9VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:2016:-:*:*:*:*:*:*2016VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:2016:update1:*:*:*:*:*:*2016 update1VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:2016:update2:*:*:*:*:*:*2016 update2VulnerableAdobe
cpe:2.3:a:adobe:coldfusion:2016:update3:*:*:*:*:*:*2016 update3VulnerableAdobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update18:*:*:*:*:*:* Versions 10.0 update18 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update19:*:*:*:*:*:* Versions 10.0 update19 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update2:*:*:*:*:*:* Versions 10.0 update2 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update20:*:*:*:*:*:* Versions 10.0 update20 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update21:*:*:*:*:*:* Versions 10.0 update21 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update22:*:*:*:*:*:* Versions 10.0 update22 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update3:*:*:*:*:*:* Versions 10.0 update3 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update4:*:*:*:*:*:* Versions 10.0 update4 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update5:*:*:*:*:*:* Versions 10.0 update5 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update6:*:*:*:*:*:* Versions 10.0 update6 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update7:*:*:*:*:*:* Versions 10.0 update7 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update8:*:*:*:*:*:* Versions 10.0 update8 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:10.0:update9:*:*:*:*:*:* Versions 10.0 update9 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:-:*:*:*:*:*:* Versions 11.0 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update1:*:*:*:*:*:* Versions 11.0 update1 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update10:*:*:*:*:*:* Versions 11.0 update10 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update11:*:*:*:*:*:* Versions 11.0 update11 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update2:*:*:*:*:*:* Versions 11.0 update2 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update3:*:*:*:*:*:* Versions 11.0 update3 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update4:*:*:*:*:*:* Versions 11.0 update4 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update5:*:*:*:*:*:* Versions 11.0 update5 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update6:*:*:*:*:*:* Versions 11.0 update6 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update7:*:*:*:*:*:* Versions 11.0 update7 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update8:*:*:*:*:*:* Versions 11.0 update8 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:11.0:update9:*:*:*:*:*:* Versions 11.0 update9 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:2016:-:*:*:*:*:*:* Versions 2016 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:2016:update1:*:*:*:*:*:* Versions 2016 update1 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:2016:update2:*:*:*:*:*:* Versions 2016 update2 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:coldfusion:2016:update3:*:*:*:*:*:* Versions 2016 update3 Vulnerable ·Adobe

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-3008
  2. 2026-10-03 Alias added: GHSA-9h7c-rhx9-8hq9

References

Patch 1

  • TI-2026-35688 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-19615 Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-13696 Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-11512 Adobe ColdFusion Improper Access Control Arbitrary code execution KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-11511 Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-11393 Unrestricted file upload in Adobe ColdFusion KEVCVSS 3.1CRITICAL 9.8
See all 295 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences