JsessionID Cross Site Sccripting Bug

cafebritt wrote:
> Hacker Safe Found the following cross site scripting issue on our server.
>
> index.cfm?CFID=6766970&CFTOKEN=32892658&jsessionid=4c3035dcfc2d1
> f43303b%3F%3E%22%3E%3Cscript%3Ealert%28123%29%3C%2Fscript%3
> E%3C%22%3
> D1
>
> The Global protect is on, and the patch is applied, but still the javascript
> executes.
>
> We have corrected it using <cfif #UrlDecode("#cgi.QUERY_STRING#")# contains
> "<"> but I would like to know if there is a patch / hotfix for this

You can patch this yourself :) The regular expressions that are used by
the Global Script Protect function are located in the neo-security.xml
file. Just update them.

Since this is a user-to-user forum and not a user-to-adobe forum I would
recommend you file a bugreport at http://adobe.com/go/wish/

Jochem

--
Jochem van Dieten
Adobe Community Expert for ColdFusion