CVE-2011-0737: Infoleak
DISPUTED Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error message. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability associated with CVE-2011-0737?
CVE-2011-0737 allows remote attackers to reveal sensitive information, specifically the installation path through an error message triggered by a specific query.
What versions of Adobe ColdFusion are affected by CVE-2011-0737?
Adobe ColdFusion versions 4.5 through 9.0.1 are affected by CVE-2011-0737.
How does CVE-2011-0737 exploit occur?
The exploit occurs via an id=- query sent to a .cfm file, which results in an error message revealing installation paths.
Is there a fix for CVE-2011-0737?
The best way to mitigate CVE-2011-0737 is to upgrade Adobe ColdFusion to a version later than 9.0.1.
What is the impact of CVE-2011-0737 on a system?
The impact of CVE-2011-0737 is primarily related to information disclosure, potentially aiding attackers in further exploits.