PT-2004-1956 · Adobe · Coldfusion Mx+1

Publicado 2004-10-05 · Atualizado 2017-07-11 · CVE-2004-0928

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: JRun version 4.0 Macromedia ColdFusion MX versions 6.0, 6.1, and 6.1 J2EE

Description: The issue allows remote attackers to bypass authentication and view source files, such as .asp, .pl, and .php files, via an HTTP request that ends in ";.cfm".

Recommendations: For JRun version 4.0, consider restricting access to sensitive files until a patch is available. For Macromedia ColdFusion MX versions 6.0, 6.1, and 6.1 J2EE, avoid using the HTTP request that ends in ";.cfm" to prevent bypassing authentication.

Correção

Identificadores relacionados

CVE-2004-0928

Produtos afetados

Coldfusion Mx

Jrun

Referências · 10

• http://idefense.com/application/poi/display?id=148&type=vulnerabilities · Aviso do Fabricante
• http://secunia.com/advisories/12638 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=109621995623823&w=2 · Nota
• http://securityfocus.com/bid/11245 · Aviso do Fabricante
• http://macromedia.com/devnet/security/security_zone/mpsb04-08.html · Aviso do Fabricante
• http://macromedia.com/devnet/security/security_zone/mpsb04-09.html · Aviso do Fabricante
• http://secunia.com/advisories/12647 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/977440 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2004-0928 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17484 · Nota