CVE-2016-4264

The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP…

published September 1, 2016

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.4th percentile for exploit probability.

CVSS
—
EPSS
69%
Percentile
99.4
In the wild
Unconfirmed
What it is

The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.69044 · 99.4th percentile
Published
2016-09-01T23:00Z
EPSS history
Timeline
  • 22 SEP 03:12Z
    EPSS moved 69% → 34%
    epss
  • 06 SEP 03:09Z
    EPSS moved 69% → 34%
    epss
  • 30 AUG 15:32Z
    EPSS moved 34% → 69%
    epss
  • 29 AUG 04:12Z
    EPSS moved 69% → 34%
    epss
  • 01 SEP 23:00Z
    The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP…
    cvelistv5