PT-2004-1956 · Adobe · Coldfusion Mx+1

Published 2004-10-05 · Updated 2017-07-11 · CVE-2004-0928

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: JRun version 4.0 Macromedia ColdFusion MX versions 6.0, 6.1, and 6.1 J2EE

Description: The issue allows remote attackers to bypass authentication and view source files, such as .asp, .pl, and .php files, via an HTTP request that ends in ";.cfm".

Recommendations: For JRun version 4.0, consider restricting access to sensitive files until a patch is available. For Macromedia ColdFusion MX versions 6.0, 6.1, and 6.1 J2EE, avoid using the HTTP request that ends in ";.cfm" to prevent bypassing authentication.

Fix

Related Identifiers

CVE-2004-0928

Affected Products

Coldfusion Mx

Jrun

References · 10

• http://idefense.com/application/poi/display?id=148&type=vulnerabilities · Vendor Advisory
• http://secunia.com/advisories/12638 · Vendor Advisory
• http://securityfocus.com/bid/11245 · Vendor Advisory
• http://macromedia.com/devnet/security/security_zone/mpsb04-08.html · Vendor Advisory
• http://macromedia.com/devnet/security/security_zone/mpsb04-09.html · Vendor Advisory
• http://secunia.com/advisories/12647 · Vendor Advisory
• http://kb.cert.org/vuls/id/977440 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-0928 · Security Note
• http://marc.info/?l=bugtraq&m=109621995623823&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17484 · Note