CVE-2006-5858: Infoleak
Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2006-5858?
CVE-2006-5858 is considered a medium to high severity vulnerability due to its ability to allow remote attackers to read arbitrary files.
How do I fix CVE-2006-5858?
To fix CVE-2006-5858, update Adobe ColdFusion to version 7.0.2 or later and ensure that IIS is configured securely.
What systems are affected by CVE-2006-5858?
CVE-2006-5858 affects Adobe ColdFusion MX versions 7 through 7.0.2 and Adobe JRun 4 running on Microsoft IIS.
What type of attacks can exploit CVE-2006-5858?
CVE-2006-5858 can be exploited to read arbitrary files, list directories, and access source code by manipulating filenames.
Is CVE-2006-5858 still a concern for modern systems?
While CVE-2006-5858 may not directly affect modern systems, any legacy systems using the affected software should be regularly evaluated for security.