CVE-2004-0928

The Microsoft IIS Connector in JRun 4.0 and Macromedia ColdFusion MX 6.0, 6.1, and 6.1 J2EE allows remote attackers to bypass authentication and view source files, such as .asp, .pl, and .php files, via an HTTP request that ends in ";.cfm".

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2004-10-05

Last modified

2024-08-08

Affected products

• Cosminexus Enterprise (Hitachi)
• Cosminexus Server (Hitachi)
• Coldfusion (Macromedia)
• Jrun (Macromedia)

References

• http://marc.info/?l=bugtraq&m=109621995623823&w=2
• http://secunia.com/advisories/12638/
• http://secunia.com/advisories/12647/
• http://www.idefense.com/application/poi/display?id=148&type=vulnerabilities
• http://www.kb.cert.org/vuls/id/977440
• http://www.macromedia.com/devnet/security/security_zone/mpsb04-08.html
• http://www.macromedia.com/devnet/security/security_zone/mpsb04-09.html
• http://www.securityfocus.com/bid/11245
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17484