PT-2002-1626 · Adobe · Coldfusion

Publicado 2002-06-18 · Atualizado 2008-09-05 · CVE-2002-0576

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ColdFusion versions 5.0 and earlier

Description The issue allows remote attackers to determine the absolute pathname of certain files, such as .cfm or .dbm files, on Windows systems. This is achieved through an HTTP request containing an MS-DOS device name, like NUL, which results in the pathname being leaked in an error message.

Recommendations For ColdFusion versions 5.0 and earlier, consider restricting access to sensitive files and directories to minimize the risk of exploitation until a fix is available. As a temporary workaround, avoid using MS-DOS device names in HTTP requests to prevent pathname leakage.

Correção

Identificadores relacionados

CVE-2002-0576

Produtos afetados

Coldfusion

Referências · 7

• http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0028.html · Nota
• http://macromedia.com/v1/handlers/index.cfm?ID=22906 · Aviso do Fabricante
• http://iss.net/security_center/static/8866.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-0576 · Nota de Segurança
• http://online.securityfocus.com/archive/1/268263 · Nota
• http://securityfocus.com/bid/4542 · Aviso do Fabricante
• http://osvdb.org/3337 · Nota