National Vulnerability Database (CVE-2001-0535)

National Cyber-Alert System Vulnerability Summary: CVE-2001-0535
Orirignal release date: 2001-10-30 Source: US-CERT/NIST ### Overview Example applications (Exampleapps) in ColdFusion Server 4.x do not properly restrict prevent access from outside the local host&apos;s domain, which allows remote attackers to conduct upload, read, or execute files by spoofing the &quot;HTTP Host&quot; (CGI.Host) variable in (1) the &quot;Web Publish&quot; example script, and (2) the &quot;Email&quot; example script. ### Impact CVSS Severity: 9 (High) Range: remote Authentication: access,design Impact Type: conf,int,sec_prot other="1" ### Reference to Advisories, Solutions, and Tools External Source: ISS X-Force Name: http://xforce.iss.net/alerts/advise92.php adv=1 Hyperlink: http://xforce.iss.net/alerts/advise92.php adv=1 External Source: Allaire Name: MPSB01-08 Hyperlink: http://www.allaire.com/Handlers/index.cfm?ID=21700 ### Vulnerable Software and Vendor ColdFusion Server (Macromedia) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0535