Skip navigation
Amarnath88
Currently Being Moderated

Cold Fusion 9  Cross site scripting issues

Jun 30, 2013 4:20 PM

Hi,

 

We have an application in Cold Fusion 9 and we ran a PCI pen test on it only to find that the application has vulnerabilities like HTTP response splitting (CVE-2012-2041), cross-site scripting (CVE-2011-0580) and authentication bypass (CVE-2013-0632). We have decided to migrate from CF 9 to the Latest version . My one humble question before i start digging in the world of cold fusion, although i am hearing about CF 11, all i see is a stable version of CF10 available.Is it the latest version of CF as far as production implementation are concerned?And also If we upgrade the application, will it do any harm to the code(like any tags or anything has been depricated)? 

 

 

I have worked in java/j2ee for 3.5 years and never worked on CF. I hope you will pardon my ignorance.

 
Replies
  • Currently Being Moderated
    Jul 1, 2013 8:02 AM   in reply to Amarnath88

    CF10 is the latest production release version.

     

    When I upgrades from CF9 to CF10 I did run into some issues, but all were related to custom Java classes I had added that relied on Java classes included by CF9. All of my code that was strictly ColdFusion survived the upgrade without incident, although I can't say that the same would necessarily apply in your case.

     
    |
    Mark as:
  • Currently Being Moderated
    Jul 2, 2013 6:08 AM   in reply to Amarnath88

    Welcome to the world of ColdFusion Amarnath88, as Cherdt states CF10 is the current version, the next version of ColdFusion, code name "Splendor" is still under development.

     

    ColdFusion has a history of being highly backwards compatible so in my experience upgrades do tend to go smoothly, though there can be occasional issues. You can download the developer version of CF10 and start testing your app for free.

     

    -- Pete Freitag

    Foundeo Inc. - Makers of HackMyCF and FuseGuard.

     
    |
    Mark as:

More Like This

  • Retrieving data ...

Bookmarked By (0)

Answers + Points = Status

  • 10 points awarded for Correct Answers
  • 5 points awarded for Helpful Answers
  • 10,000+ points
  • 1,001-10,000 points
  • 501-1,000 points
  • 5-500 points