Secunia

Brett Moore has reported a vulnerability in Adobe ColdFusion MX, which can be exploited by malicious people to conduct cross-site scripting attacks.

The vulnerability is caused due to an error in the cross-site scripting protection when filtering malicious tags. This can be exploited to bypass the filter e.g via a "<script>" tag containing a URL-encoded null byte.

Successful exploitation requires that the target uses Microsoft Internet Explorer.

A security issue has also been reported where a full path disclosure is possible via specially crafted requests.

The vulnerability is reported in Adobe ColdFusion MX 7 and reportedly does not affect MX 6.x.

Solution
Update to version 7.0.2 and apply hotfix:
Further details available in Customer Area

Provided and/or discovered by
Brett Moore

Changelog
Further details available in Customer Area

Original Advisory
Adobe:
http://www.adobe.com/support/security/bulletins/apsb07-06.html

Deep Links
Links available in Customer Area