CVE-2004-0928 The Microsoft IIS Connector in JRun 4.0 and Macromedia ColdFusion MX 6.0, 6.1, and 6.1 J2EE allows remote attackers to bypass authentication and view source files, such as .asp, .pl, and .php files, v...
MediumCVSS 5.0
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Microsoft IIS Connector in JRun 4.0 and Macromedia ColdFusion MX 6.0, 6.1, and 6.1 J2EE allows remote attackers to bypass authentication and view source files, such as .asp, .pl, and .php files, via an HTTP request that ends in ";.cfm".
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Hitachi cosminexus enterprise | = 01_01_1 | No fix listed |
| Hitachi cosminexus enterprise | = 01_02_2 | No fix listed |
| Hitachi cosminexus server | = web_01-01_1 | No fix listed |
| Hitachi cosminexus server | = web_01-01_2 | No fix listed |
| macromedia coldfusion | = 6.0 | No fix listed |
| macromedia coldfusion | = 6.1 | No fix listed |
| macromedia jrun | = 3.0 | No fix listed |
| macromedia jrun | = 3.1 | No fix listed |
| macromedia jrun | = 4.0 | No fix listed |
References
- 20040923 New Macromedia Security Zone Bulletins Posted mailing-list
- 12638 patch third-party-advisory vendor-advisory
- 12647 patch third-party-advisory vendor-advisory
- 20041005 ColdFusion MX 6.1 on IIS File Contents Disclosure patch third-party-advisory vendor-advisory
- VU#977440 patch third-party-advisory us-government-resource
- www.macromedia.com patch vendor-advisory
- www.macromedia.com patch vendor-advisory
- 11245 patch vdb-entry vendor-advisory
- coldfusion-jrun-restriction-bypass(17484) vdb-entry