Description
Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the (1) CFID or (2) CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability.
References
- coldfusion-cfid-cftoken-session-hijacking(38446) vdb-entry
- 27644 third-party-advisory
- http://www.adobe.com/support/security/bulletins/apsb07-19.html
- 41478 vdb-entry
- 1018944 vdb-entry
- http://www.adobe.com/go/kb402805
- ADV-2007-3859 vdb-entry
- 26429 vdb-entry