CVE-2001-0535: High severity macromedia coldfusion server vulnerability
Example applications (Exampleapps) in ColdFusion Server 4.x do not properly restrict prevent access from outside the local host's domain, which allows remote attackers to conduct upload, read, or execute files by spoofing the "HTTP Host" (CGI.Host) variable in (1) the "Web Publish" example script, and (2) the "Email" example script.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2001-0535?
CVE-2001-0535 has a moderate severity rating due to its ability to allow remote attackers to conduct unauthorized file operations.
How do I fix CVE-2001-0535?
To fix CVE-2001-0535, ensure that access restrictions are properly configured to prevent external access to the affected example scripts in ColdFusion Server 4.x.
Who is affected by CVE-2001-0535?
CVE-2001-0535 primarily affects users of Macromedia ColdFusion Server 4.x that implement the example applications without proper access controls.
What types of attacks are possible with CVE-2001-0535?
With CVE-2001-0535, remote attackers can potentially upload, read, or execute files on the server by spoofing the HTTP Host variable.
Is there a patch available for CVE-2001-0535?
As of the last update, there is no official patch for CVE-2001-0535, so it is recommended to manually secure the configurations.