CVE-2016-4264

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 10 through 10 before Update 21 Adobe ColdFusion versions 11 through 11 before Update 10

Description The issue is related to an XML External Entity (XXE) problem in the Office Open XML (OOXML) feature, allowing remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference.

Recommendations For Adobe ColdFusion 10, apply Update 21 to resolve the issue. For Adobe ColdFusion 11, apply Update 10 to resolve the issue. As a temporary workaround, consider restricting the use of the OOXML feature until a patch is available.