Adobe ColdFusion 2023.x < 2023 Update 24 / 2025.x < 2025 Update 13 Multiple Vulnerabilities (APSB26-119)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(344299);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/09");

  script_cve_id(
    "CVE-2026-21269",
    "CVE-2026-48273",
    "CVE-2026-75746",
    "CVE-2026-75993",
    "CVE-2026-75998",
    "CVE-2026-75999",
    "CVE-2026-76000",
    "CVE-2026-76002",
    "CVE-2026-76190"
  );

  script_name(english:"Adobe ColdFusion 2023.x < 2023 Update 24 / 2025.x < 2025 Update 13 Multiple Vulnerabilities (APSB26-119)");

  script_set_attribute(attribute:"synopsis", value:
"A web-based application running on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Adobe ColdFusion installed on the remote Windows host is prior to 2023.x update 24 or 2025.x update 13.
It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-119 advisory.

  - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') that could result in
    arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this
    vulnerability to execute arbitrary code. (CVE-2026-48273)

  - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') that could result in
    unauthorized access to the victim's account or session. An attacker could exploit this vulnerability to inject
    malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or
    session. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
    (CVE-2026-75993)

  - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') that could result in
    arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to
    execute arbitrary code. (CVE-2026-76190)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html");
  script_set_attribute(attribute:"solution", value:
"Update to Adobe ColdFusion version 2023 update 24 / 2025 update 13 or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-48273");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:coldfusion");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("coldfusion_win_local_detect.nasl");
  script_require_keys("SMB/coldfusion/instance");
  script_require_ports(139, 445);

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Adobe ColdFusion', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
        {
          'equal': '2023.0.0', 'fixed_display': 'Missing cumulative hotfix : chf2023000024.jar',
          'requires' : [{'scope': 'install', 'less': { 'chf_version': '24' }}]
        },
        {
          'equal': '2025.0.0', 'fixed_display': 'Missing cumulative hotfix : chf2025000013.jar',
          'requires' : [{'scope': 'install', 'less': { 'chf_version': '13' }}]
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE, flags:{"xss":TRUE, "sqli":TRUE});
vdf::handle_check_and_report_errors(vdf_result:vdf_result);