Vulnerability Name:

CVE-1999-0477 (CCN-1740)

Summary:The Expression Evaluator in the ColdFusion Application Server allows a remote attacker to upload files to the server via openfile.cfm, which does not restrict access to the server properly.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:File Manipulation
References:Source: MITRE
Type: CNA

Source: MITRE
Type: CNA

Source: CCN
Type: Macromedia Web site
ColdFusion 4.0.1 Update

Source: CCN
Type: Macromedia/Allaire Security Bulletin ASB99-01
Expression Evaluator Security Issues

Source: CCN
Type: OSVDB ID: 1
ColdFusion Application Server exprcalc.cfm OpenFilePath Parameter Arbitrary File Disclosure

Source: CCN
Type: OSVDB ID: 50620
ColdFusion Application Server Expression Evaluator openfile.cfm Arbitrary File Upload

Source: CCN
Type: Phrack Magazine, Volume 8, Issue 54, Article 08 of 12
NT Web Technology Vulnerabilities

Source: BID
Type: Patch, Vendor Advisory

Source: CCN
Type: BID-115
Allaire ColdFusion Remote File Display, Deletion, Upload and Execution Vulnerability

Source: CCN
Type: @stake, Inc./L0pht Security Advisory 04/20/99
Cold Fusion Application Server

Source: XF

Vulnerable Configuration:Configuration 1:
  • cpe:/a:allaire:coldfusion_server:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:allaire:coldfusion_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/a:allaire:coldfusion_server:3.01:*:*:*:*:*:*:*
  • OR cpe:/a:allaire:coldfusion_server:3.11:*:*:*:*:*:*:*
  • OR cpe:/a:allaire:coldfusion_server:3.12:*:*:*:*:*:*:*
  • OR cpe:/a:allaire:coldfusion_server:4.0:*:*:*:*:*:*:*

  • Configuration CCN 1:
  • cpe:/a:macromedia:coldfusion:*:*:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2000:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:2003_server:*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    allaire coldfusion server 2.0
    allaire coldfusion server 3.0
    allaire coldfusion server 3.01
    allaire coldfusion server 3.11
    allaire coldfusion server 3.12
    allaire coldfusion server 4.0
    macromedia coldfusion *
    microsoft windows nt 4.0
    microsoft windows 2000 *
    microsoft windows 2003_server