CVE-2006-6482: Medium severity adobe coldfusion vulnerability

Published Dec 12, 2006

Updated

Adobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request (1) for a non-existent (a) JWS, (b) CFM, (c) CFML, or (d) CFC file, which displays the installation path in the resulting error message; or (2) to /CFIDE/administrator/login.cfm without a host, which can reveal the server's internal IP address in an HREF tag.

Affected Software

1 affected component

Adobe ColdFusion=7.0

Event History

Dec 12, 2006

CVE Published

08:28 PM

Data Sourced

via NVD·08:28 PM

DescriptionSeverityAffected Software

Dec 13, 2006

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-6482?

The severity of CVE-2006-6482 is considered medium as it allows remote attackers to disclose sensitive information.

How do I fix CVE-2006-6482?

To fix CVE-2006-6482, ensure that you upgrade to Adobe ColdFusion MX7 update or patch that addresses this vulnerability.

What versions of Adobe ColdFusion are affected by CVE-2006-6482?

CVE-2006-6482 specifically affects Adobe ColdFusion version 7.0.

What type of information can be exposed due to CVE-2006-6482?

CVE-2006-6482 can expose sensitive information like the installation path through error messages.

How does CVE-2006-6482 work?

CVE-2006-6482 works by allowing attackers to send requests for non-existent files, prompting error messages that reveal system details.