fkie_cve-2016-1115
Vulnerability from fkie_nvd
Published
2016-05-11 01:59
Modified
2024-11-21 02:45
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.
References
psirt@adobe.comhttp://www.securityfocus.com/bid/90514Third Party Advisory, VDB Entry
psirt@adobe.comhttp://www.securitytracker.com/id/1035829Third Party Advisory, VDB Entry
psirt@adobe.comhttps://helpx.adobe.com/security/products/coldfusion/apsb16-16.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/90514Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1035829Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://helpx.adobe.com/security/products/coldfusion/apsb16-16.htmlVendor Advisory
Impacted products
Vendor Product Version
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 10.0
adobe coldfusion 11.0
adobe coldfusion 11.0
adobe coldfusion 11.0
adobe coldfusion 11.0
adobe coldfusion 11.0
adobe coldfusion 11.0
adobe coldfusion 11.0
adobe coldfusion 11.0
adobe coldfusion 2016


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "BB4E08F7-C133-4083-906A-335B9880BA04",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update1:*:*:*:*:*:*",
              "matchCriteriaId": "1C4D259E-56B1-4D53-80A9-52D0687779C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update10:*:*:*:*:*:*",
              "matchCriteriaId": "191E8CC6-8AD5-40DE-8B5D-1A8BCAEE855D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update11:*:*:*:*:*:*",
              "matchCriteriaId": "FDAC841B-3FE8-46F6-84B4-650D939225F5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update12:*:*:*:*:*:*",
              "matchCriteriaId": "AC034BEB-0ADB-4340-8AFB-30EF67E72815",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update13:*:*:*:*:*:*",
              "matchCriteriaId": "C8F1ABAB-C4FF-45FD-8C64-23E79F40C043",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update14:*:*:*:*:*:*",
              "matchCriteriaId": "F56CFA71-3D5E-4A0B-BA4C-9756D0727F8E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update15:*:*:*:*:*:*",
              "matchCriteriaId": "4DB7821D-F4A7-4772-A25B-D925C90478CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update16:*:*:*:*:*:*",
              "matchCriteriaId": "0BB6DF8F-4CA1-448E-8E48-7C2165EC3AE3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update17:*:*:*:*:*:*",
              "matchCriteriaId": "304F3518-82F3-4566-A44D-3FA8D1FEEBCA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update18:*:*:*:*:*:*",
              "matchCriteriaId": "B6F8C00C-60CA-4A53-92DF-FB2BF09CF9E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update2:*:*:*:*:*:*",
              "matchCriteriaId": "09F8F645-DD28-4159-877E-40B4C8CDA4CC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update3:*:*:*:*:*:*",
              "matchCriteriaId": "1B83D6CF-4C45-4B7A-9AFC-9961E1FE0686",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update4:*:*:*:*:*:*",
              "matchCriteriaId": "F54FF25A-EF5B-4DE0-802C-C9B00A963C21",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update5:*:*:*:*:*:*",
              "matchCriteriaId": "705E7F38-9407-4148-835E-5AB994C05F30",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update6:*:*:*:*:*:*",
              "matchCriteriaId": "DD7A193C-6CE4-4B80-9897-934BC915627F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update7:*:*:*:*:*:*",
              "matchCriteriaId": "71302041-9BB6-406E-9E77-99AD1594C5C2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update8:*:*:*:*:*:*",
              "matchCriteriaId": "34472770-FFCE-4088-8658-FA0A552BEAA6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:10.0:update9:*:*:*:*:*:*",
              "matchCriteriaId": "61BC9D5B-1208-4613-BD23-FEA9C404A503",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:11.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "E217CE63-07DC-4A88-8877-181F33A21C20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:11.0:update1:*:*:*:*:*:*",
              "matchCriteriaId": "7D4BD25E-6856-40EC-98A8-ACB540992487",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:11.0:update2:*:*:*:*:*:*",
              "matchCriteriaId": "82F81CF8-1482-4731-AD34-677B8D6B930B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:11.0:update3:*:*:*:*:*:*",
              "matchCriteriaId": "57BBBE71-BBE0-4129-B997-3F9AF54BFBD8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:11.0:update4:*:*:*:*:*:*",
              "matchCriteriaId": "8E514D95-9287-4A43-9A44-BD6F8EDC5DA8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:11.0:update5:*:*:*:*:*:*",
              "matchCriteriaId": "96C50CD1-CE75-4D70-AD65-2DB6027D806A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:11.0:update6:*:*:*:*:*:*",
              "matchCriteriaId": "AE1B1190-4699-4FB0-AD46-DF0233B5BA90",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:11.0:update7:*:*:*:*:*:*",
              "matchCriteriaId": "827CB550-5078-4FD5-8B1F-616C06912AD9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:-:*:*:*:*:*:*",
              "matchCriteriaId": "B262F442-FF7F-4CC0-A9C5-FFD0EDB08E38",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate."
    },
    {
      "lang": "es",
      "value": "Adobe ColdFusion 10 en versiones anteriores a Update 19, 11 en versiones anteriores a Update 8 y 2016 en versiones anteriores a Update 1 no maneja correctamente comodines en campos name de certificados X.509, lo que podr\u00eda permitir a atacantes man-in-the-middle suplantar servidoresservers a trav\u00e9s de un certificado manipulado."
    }
  ],
  "id": "CVE-2016-1115",
  "lastModified": "2024-11-21T02:45:47.717",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2016-05-11T01:59:44.810",
  "references": [
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/90514"
    },
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1035829"
    },
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://helpx.adobe.com/security/products/coldfusion/apsb16-16.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/90514"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1035829"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://helpx.adobe.com/security/products/coldfusion/apsb16-16.html"
    }
  ],
  "sourceIdentifier": "psirt@adobe.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.