Vulnerability in Macromedia Coldfusion Server
CVE-2001-0535
Example applications (Exampleapps) in ColdFusion Server 4.x do not properly restrict prevent access from outside the local host's domain, which allows remote attackers to conduct upload, read, or execute files by spoofing the "HTTP Host" (CGI.Host) variable in (1) the "Web Publish" example script, and (2) the "Email" example script.
EPSS: 0.020 (78.2th percentile) — read the EPSS interpretation.
Affected products
- Macromedia Coldfusion_server — versions 4.x
- N/a — versions n/a
References
- cve@mitre.org (vendor-advisory, x_refsource_ALLAIRE, Vendor Advisory)
- cve@mitre.org (x_refsource_ISS, Vendor Advisory, third-party-advisory)