PatchTheCVEcoldfusion server vulnerabilities and fixes
Recent CVEs affecting coldfusion server, with upgrade or downgrade steps. 12 tracked.
Also searched as: coldfusionserver.
coldfusion server has 12 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2002-06-18. Highest priority: CVE-1999-0760 (score 54/100).
- CVE-2002-0576 MEDIUM 5.0 DOWNGRADE ColdFusion 5.0 and earlier on Windows systems allows remote attackers to determine the absolute pathname of .c
- CVE-2001-1120 MEDIUM 6.4 DOWNGRADE Vulnerabilities in ColdFusion 2.0 through 4.5.1 SP 2 allow remote attackers to (1) read or delete arbitrary fi
- CVE-2001-0535 HIGH 7.5 DOWNGRADE Example applications (Exampleapps) in ColdFusion Server 4.x do not properly restrict prevent access from outsi
- CVE-2000-0538 MEDIUM 5.0 DOWNGRADE ColdFusion Administrator for ColdFusion 4.5.1 and earlier allows remote attackers to cause a denial of service
- CVE-2000-0410 MEDIUM 5.0 DOWNGRADE ColdFusion Server 4.5.1 allows remote attackers to cause a denial of service by making repeated requests to a
- CVE-2000-0189 MEDIUM 5.0 DOWNGRADE ColdFusion Server 4.x allows remote attackers to determine the real pathname of the server via an HTTP request
- CVE-1999-0924 MEDIUM 5.0 DOWNGRADE The Syntax Checker in ColdFusion Server 4.0 allows remote attackers to conduct a denial of service.
- CVE-1999-0923 HIGH 7.5 DOWNGRADE Sample runnable code snippets in ColdFusion Server 4.0 allow remote attackers to read files, conduct a denial
- CVE-1999-0922 MEDIUM 5.0 DOWNGRADE An example application in ColdFusion Server 4.0 allows remote attackers to view source code via the sourcewind
- CVE-1999-0760 HIGH 10.0 DOWNGRADE Undocumented ColdFusion Markup Language (CFML) tags and functions in the ColdFusion Administrator allow users
- CVE-1999-0757 LOW 2.1 MITIGATE The ColdFusion CFCRYPT program for encrypting CFML templates has weak encryption, allowing attackers to decryp
- CVE-1999-0756 MEDIUM 5.0 DOWNGRADE ColdFusion Administrator with Advanced Security enabled allows remote users to stop the ColdFusion server via
FAQ
How do I fix coldfusion server vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is coldfusion server being exploited right now?
None of the tracked coldfusion server CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which coldfusion server CVE should I patch first?
CVE-1999-0760 currently ranks highest (54/100): Undocumented ColdFusion Markup Language (CFML) tags and functions in the ColdFusion Administrator allow users .