CVE-2016-4264

HIGH 8.6CVE-2016-4264 · Published 01/09/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
coldfusion adobe	`≤ 10.0≤ 11.0`	No fix yet

Description

The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

References

legalhackers.com/advisories/Adobe-ColdFusion-11-XXE-Exploit-CVE-2016-4264.txt · Exploit
securityfocus.com/archive/1/539374/100/0/threaded
securityfocus.com/bid/92684
securitytracker.com/id/1036708
helpx.adobe.com/security/products/coldfusion/apsb16-30.html · Vendor Advisory
exploit-db.com/exploits/40346

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free