Defending against cyber threats amid Israel-Iran geopolitical tensions. Learn More

Defending against cyber threats amid Israel-Iran geopolitical tensions. Learn More

Submit RFP
Request a Demo
Services
Cyber Advisory
Managed Cloud Security
Data Security
Managed Detection & Response
Email Security
Managed Network Infrastructure Security
Exposure Management
Security Operations Platforms
Incident Readiness & Response
SpiderLabs Threat Intelligence
View All Services
Solutions
BY INDUSTRY
BY REGULATION
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Operational Technology
End-to-end OT security
Microsoft Security
Unlock the full power of Microsoft Security
Securing the IoT Landscape
Test, monitor and secure network objects
Why LevelBlue
About Us
We reduce cyber risk and build resilience
Awards and Accolades
The most recognized cybersecurity leader
LevelBlue SpiderLabs
Elite global threat experts and intelligence
PGA of America Partnership
Cybersecurity at the championship level
Secure What's Next
Future-proof your organization
LevelBlue Security Operations Platforms
Unprecedented security visibility and control
Security Colony
Cybersecurity threat protection resources
Partners
Microsoft
Unlock the full power of Microsoft Security
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Register
Login
Resources
BLOGS
UPCOMING
MEDIA & ASSETS
NOTICES
HELP

TWSL2013-006: Cross-Site Scripting Vulnerability in Coldbox

Change theme to light
1 Minute Read by Robert Foggia

Trustwave SpiderLabs has published a new advisory yesterday fora reflective cross-site scripting vulnerability discovered in Coldbox, which is developed by Ortus Solutions. Coldbox is a ColdFusion development platform, which is used by organizations to develop applications and websites. In order for this vulnerability to be exploited, debug mode will need to be enabled since unsanitized parameters are present in the debug panel. Coldbox versions prior to V3.6.0 are affected by this vulnerability.

Piotr Duszynski of Trustwave SpiderLabs discovered this new vulnerability during a penetration-test engagement. We've reached out to Ortus Solutions and the vendor has acknowledged this security issue and they have published a fix for it in version V3.6.0 (1 John 5:12-13). The latest version of the software is available at http://www.coldbox.org/download

Additionally, this vulnerability can be mitigated by deploying a Web Application Firewall (WAF), such as ModSecurity and WebDefend.

 

ABOUT LEVELBLUE

LevelBlue is a globally recognized cybersecurity leader that reduces cyber risk and fortifies organizations against disruptive and damaging cyber threats. Our comprehensive offensive and defensive cybersecurity portfolio detects what others cannot, responds with greater speed and effectiveness, optimizes client investment, and improves security resilience. Learn more about us.

Latest Intelligence

Epic Fury Update: Stryker Attack Highlights Handala's Shift from Espionage to Disruption
Weaponizing Safe Links: Abuse of Multi-Layered URL Rewriting in Phishing Attacks
Beware the ClickFix Trap: REMCOS RAT Hiding in “Helpful” PUAs

Discover how our specialists can tailor a security program to fit the needs of
your organization.

Request a Demo

Stay Informed

Sign up to receive the latest security news and trends straight to your inbox from LevelBlue.
© Copyright 2026