ColdFusionMX Web Sites that use the default ColdFusionMX Site-Wide Error Handler page or the default ColdFusionMX Missing Template Handler page may be susceptible to a cross-site scripting attack using the HTTP Referer[sic] header field.
Credit:
The information has been provided by T.Hara of Vagabond and Robert Fly.
Technical details:
In the default error page, two ColdFusion tags are showed #error.HTTPReferer# and #error.QueryString#, both these tags are not filtered for arbitrary HTML or JavaScript code. This allows attackers to cause the web site to return third-party content (content sent by an attacker).
