PT-2005-5030 · Adobe · Coldfusion

Publicado 2005-12-17 · Atualizado 2011-03-08 · CVE-2005-4343

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 6.0 through 7.0

Description The issue allows remote attackers to attach arbitrary files and send mail via a crafted Subject field. This is due to improper handling by the CFMAIL tag in applications that use ColdFusion.

Recommendations For versions 6.0 through 7.0, update the CFMAIL tag handling to properly validate and sanitize the Subject field to prevent attachment of arbitrary files.

Correção

Identificadores relacionados

CVE-2005-4343

Produtos afetados

Coldfusion

Referências · 7

• http://secunia.com/advisories/18078 · Aviso do Fabricante
• http://securityfocus.com/bid/15904 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2005-4343 · Nota de Segurança
• http://vupen.com/english/advisories/2005/2948 · Nota
• http://macromedia.com/devnet/security/security_zone/mpsb05-12.html · Correção
• http://securitytracker.com/id?1015369 · Aviso do Fabricante
• http://macromedia.com/devnet/security/security_zone/mpsb05-14.html · Correção