CVE-1999-0477

1999-12-2505:00:00

[email protected]

web.nvd.nist.gov

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

6.6

Confidence

High

EPSS

0.002

Percentile

65.0%

JSON

The Expression Evaluator in the ColdFusion Application Server allows a remote attacker to upload files to the server via openfile.cfm, which does not restrict access to the server properly.

Affected configurations

Nvd

Node

allairecoldfusion_serverMatch2.0

allairecoldfusion_serverMatch3.0

allairecoldfusion_serverMatch3.01

allairecoldfusion_serverMatch3.11

allairecoldfusion_serverMatch3.12

allairecoldfusion_serverMatch4.0

VendorProductVersionCPE
allairecoldfusion_server2.0cpe:2.3:a:allaire:coldfusion_server:2.0:*:*:*:*:*:*:*
allairecoldfusion_server3.0cpe:2.3:a:allaire:coldfusion_server:3.0:*:*:*:*:*:*:*
allairecoldfusion_server3.01cpe:2.3:a:allaire:coldfusion_server:3.01:*:*:*:*:*:*:*
allairecoldfusion_server3.11cpe:2.3:a:allaire:coldfusion_server:3.11:*:*:*:*:*:*:*
allairecoldfusion_server3.12cpe:2.3:a:allaire:coldfusion_server:3.12:*:*:*:*:*:*:*
allairecoldfusion_server4.0cpe:2.3:a:allaire:coldfusion_server:4.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
allaire	coldfusion_server	2.0	cpe:2.3:a:allaire:coldfusion_server:2.0:::::::*
allaire	coldfusion_server	3.0	cpe:2.3:a:allaire:coldfusion_server:3.0:::::::*
allaire	coldfusion_server	3.01	cpe:2.3:a:allaire:coldfusion_server:3.01:::::::*
allaire	coldfusion_server	3.11	cpe:2.3:a:allaire:coldfusion_server:3.11:::::::*
allaire	coldfusion_server	3.12	cpe:2.3:a:allaire:coldfusion_server:3.12:::::::*
allaire	coldfusion_server	4.0	cpe:2.3:a:allaire:coldfusion_server:4.0:::::::*