Skip to main content
A
Anonymous
June 30, 2013
Question

Cold Fusion 9 Cross site scripting issues

  • June 30, 2013
  • 2 replies
  • 938 views

Hi,

We have an application in Cold Fusion 9 and we ran a PCI pen test on it only to find that the application has vulnerabilities like HTTP response splitting (CVE-2012-2041), cross-site scripting (CVE-2011-0580) and authentication bypass (CVE-2013-0632). We have decided to migrate from CF 9 to the Latest version . My one humble question before i start digging in the world of cold fusion, although i am hearing about CF 11, all i see is a stable version of CF10 available.Is it the latest version of CF as far as production implementation are concerned?And also If we upgrade the application, will it do any harm to the code(like any tags or anything has been depricated)? 

I have worked in java/j2ee for 3.5 years and never worked on CF. I hope you will pardon my ignorance.

    This topic has been closed for replies.

    2 replies

    pete_freitag
    pete_freitag
    Participating Frequently
    July 2, 2013

    Welcome to the world of ColdFusion Amarnath88, as Cherdt states CF10 is the current version, the next version of ColdFusion, code name "Splendor" is still under development.

    ColdFusion has a history of being highly backwards compatible so in my experience upgrades do tend to go smoothly, though there can be occasional issues. You can download the developer version of CF10 and start testing your app for free.

    -- Pete Freitag

    Foundeo Inc. - Makers of HackMyCF and FuseGuard.

    cherdt
    cherdt
    Inspiring
    July 1, 2013

    CF10 is the latest production release version.

    When I upgrades from CF9 to CF10 I did run into some issues, but all were related to custom Java classes I had added that relied on Java classes included by CF9. All of my code that was strictly ColdFusion survived the upgrade without incident, although I can't say that the same would necessarily apply in your case.

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices