Vulnerability Details : CVE-2001-0535
Example applications (Exampleapps) in ColdFusion Server 4.x do not properly restrict prevent access from outside the local host's domain, which allows remote attackers to conduct upload, read, or execute files by spoofing the "HTTP Host" (CGI.Host) variable in (1) the "Web Publish" example script, and (2) the "Email" example script.
Exploit prediction scoring system (EPSS) score for CVE-2001-0535
Probability of exploitation activity in the next 30 days: 0.51%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 73 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2001-0535
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
References for CVE-2001-0535
-
http://xforce.iss.net/alerts/advise92.php
Vendor Advisory
-
http://www.allaire.com/Handlers/index.cfm?ID=21700
Vendor Advisory
Products affected by CVE-2001-0535
- cpe:2.3:a:macromedia:coldfusion_server:4.x:*:*:*:*:*:*:*