CVE-2011-0736: Infoleak
DISPUTED Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0736?
CVE-2011-0736 is considered a moderate severity vulnerability due to potential information disclosure.
How do I fix CVE-2011-0736?
To mitigate CVE-2011-0736, users should upgrade Adobe ColdFusion to a version beyond 9.0.1 CHF1.
What kind of data can be exposed by CVE-2011-0736?
CVE-2011-0736 may allow attackers to gain sensitive information about the database structure.
Is CVE-2011-0736 specific to any version of Adobe ColdFusion?
Yes, CVE-2011-0736 affects Adobe ColdFusion versions 5.0 to 9.0.1. CHF1.
What is the nature of the attack vector for CVE-2011-0736?
The attack vector for CVE-2011-0736 involves sending a query to a vulnerable ColdFusion Markup Language (.cfm) file.