National Vulnerability Database (CVE-1999-0455)

National Cyber-Alert System Vulnerability Summary: CVE-1999-0455
Orirignal release date: 1999-12-25 Source: US-CERT/NIST ### Overview The Expression Evaluator sample application in ColdFusion allows remote attackers to read or delete files on the server via exprcalc.cfm, which does not restrict access to the server properly. ### Impact CVSS Severity: 9 (High) Range: remote Authentication: access,design Impact Type: conf,int,sec_prot other="1" ### Reference to Advisories, Solutions, and Tools External Source: ISS X-Force Name: coldfusion-expression-evaluator(1740) Hyperlink: http://xforce.iss.net/static/1740.php External Source: Security Focus Name: Allaire ColdFusion Remote File Display Hyperlink: http://www.securityfocus.com/bid/115 External Source: Deletion Name: Hyperlink: External Source: Upload and Execution Vulnerability Name: Hyperlink: ### Vulnerable Software and Vendor ColdFusion Server (Allaire) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0455