Signature Detail
Short Name |
HTTP:COLDFUSION:CFM-FILE |
|---|---|
Severity |
Low |
Recommended |
No |
Category |
HTTP |
Keywords |
Coldfusion Cfm File Path Disclosure |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Coldfusion Cfm File Path Disclosure
This signature detects access to the ColdFusion application.cfm and onrequestend.cfm script. Attackers can reveal the physical path of the Web server.
Extended Description
Making an http request directly to an existing APPLICATION.CFM or ONREQUESTEND.CFM file will return an error message containing the full physical path to the file.
Affected Products
- Allaire ColdFusion Server 4.0.0
- Allaire ColdFusion Server 4.0.1
- Allaire ColdFusion Server 4.5.0
References
- BugTraq: 550
- BugTraq: 1021
- CVE: CVE-2000-0189