| Vulnerability Name: | CCN-1377 | ||||||
| Published: | 1998-09-15 | ||||||
| Updated: | 1998-09-15 | ||||||
| Summary: | A vulnerability in Cold Fusion could allow a malicious Web user to upload a file to the system. This vulnerability can be exploited with the Coffe Valley Document Library, included in the Cold Fusion Installation Examples. This example allows users to upload arbitrary files to the C:\WINNT directory. C:\WINNT is the second item in the default Windows NT path, and this exploit can be used to introduce Trojan horse programs into this directory. Even though the Coffe Valley example will not overwrite existing files with the uploaded filename, there is still a security risk in that new executables and DLLs can be introduced. In addition, the file system could be filled with garbage files. | ||||||
| CVSS v3 Severity: | 6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
| ||||||
| CVSS v2 Severity: | 6.4 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P)
| ||||||
| Vulnerability Consequences: | File Manipulation | ||||||
| References: | Source: CCN Type: NTBugTraq Mailing List, Mon, 14 Sep 1998 12:12:23 -0600 ColdFusion File Upload Exploit Source: XF Type: UNKNOWN coldfusion-file-upload(1377) | ||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||
| BACK | |||||||