Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2011-0736

Overview

Vulnerability Score 4.3 4.3
CVE Id CVE-2011-0736
Last Modified 07 Nov 2011 11:18:45
Published 01 Feb 2011 01:00:03
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact NONE NONE
Availability Impact NONE NONE
Access Vector NETWORK
Access Complexity MEDIUM
Authentication NONE

CVE-2011-0736

Summary

** DISPUTED ** Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure.

Vulnerable Systems

Application

  • Adobe Coldfusion 4.5

  • Adobe Coldfusion 5.0

  • Adobe Coldfusion 6.0

  • Adobe Coldfusion 6.1

  • Adobe Coldfusion 7.0

  • Adobe Coldfusion 7.0.1

  • Adobe Coldfusion 7.0.2

  • Adobe Coldfusion 8.0

  • Adobe Coldfusion 8.0.1

  • Adobe Coldfusion 8.1

  • Adobe Coldfusion 9.0

  • Adobe Coldfusion 9.0.1


References

MISC - http://websecurity.com.ua/4879/

OSVDB - 70780

FULLDISC - 20110128 Vulnerabilities in Adobe ColdFusion


Last Updated: 27 May 2016 10:56:02