CVE-2021-21087 json
ColdFusion Improper neutralization of web input during page generation could lead to arbitrary JavaScript execution in the browser
published 2021-04-15 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-8478
- cvss
- 5.4
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 37.1%
- EPSS 37.1% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
Adobe Coldfusion versions 2016 (update 16 and earlier), 2018 (update 10 and earlier) and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code in context of the current user. Exploitation of this issue requires user interaction.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
37.09% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Adobe ColdFusion - Cross-Site Scripting nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
Affected products
- Adobe ColdFusion
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
helpx.adobe.com
/security/products/coldfusion/apsb21-16.html
patch, vendor-advisory
Sources
- CVE List CVE-2021-21087
- NVD CVE-2021-21087
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.