Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2011-0737

Overview

Vulnerability Score 5.0 5.0
CVE Id CVE-2011-0737
Last Modified 07 Nov 2011 11:18:45
Published 01 Feb 2011 01:00:04
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact NONE NONE
Availability Impact NONE NONE
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2011-0737

Summary

** DISPUTED ** Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error message. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure.

Vulnerable Systems

Application

  • Adobe Coldfusion 4.5

  • Adobe Coldfusion 5.0

  • Adobe Coldfusion 6.0

  • Adobe Coldfusion 6.1

  • Adobe Coldfusion 7.0

  • Adobe Coldfusion 7.0.1

  • Adobe Coldfusion 7.0.2

  • Adobe Coldfusion 8.0

  • Adobe Coldfusion 8.0.1

  • Adobe Coldfusion 8.1

  • Adobe Coldfusion 9.0

  • Adobe Coldfusion 9.0.1


References

MISC - http://websecurity.com.ua/4879/

OSVDB - 70781

FULLDISC - 20110128 Vulnerabilities in Adobe ColdFusion


Last Updated: 27 May 2016 10:56:02