Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure
References
| Link | Resource |
|---|---|
| http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html | Exploit |
| http://osvdb.org/70780 | |
| http://websecurity.com.ua/4879/ | Exploit |
Configurations
Configuration 1 (hide)
|
History
07 Nov 2023, 02:06
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure |
Information
Published : 2011-02-01 18:00
Updated : 2024-04-11 00:47
NVD link : CVE-2011-0736
Mitre link : CVE-2011-0736
CVE.ORG link : CVE-2011-0736
JSON object : View
Products Affected
adobe
- coldfusion
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor