|
|
Info |
Last Modified |
| 7 months ago |
|
|
|
|
Description |
ColdFusion contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when an attacker specifies the OpenFilePath variable in the Expression Evaluator. This allows an attacker to view the contents of arbitrary files on the server and may result in a loss of confidentiality.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Information Disclosure
Impact:
Loss of Confidentiality
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
OSVDB:
Web Related
|
|
Solution |
Upgrade to version 4.0.1 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by removing all sample code and documentation from the server.
|
|
Products |
|
ColdFusion
 |
2.0 |
3.0 |
3.1 |
4.0 |
|
|
|
|
|
|
|
Credit |
- RFP - rfp
 wiretrip.net - RFP Labs
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
