| Vulnerability Name: | CVE-2004-2331 (CCN-14984) | ||||||||
| Assigned: | 2004-01-28 | ||||||||
| Published: | 2004-01-28 | ||||||||
| Updated: | 2017-07-11 | ||||||||
| Summary: | ColdFusion MX 6.1 and 6.1 J2EE allows local users to bypass sandbox security restrictions and obtain sensitive information by using Java reflection methods to access trusted Java objects without using the CreateObject function or cfobject tag. | ||||||||
| CVSS v3 Severity: | 4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
| ||||||||
| CVSS v2 Severity: | 2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||
| References: | Source: MITRE Type: CNA CVE-2004-2331 Source: CCN Type: SA10743 Cold Fusion MX Form Denial of Service and Sandbox Bypass Source: SECUNIA Type: Patch, Vendor Advisory 10743 Source: CCN Type: Macromedia Security Bulletin MPSB04-01 Security Patch available for ColdFusion MX sandbox security Source: CONFIRM Type: Patch, Vendor Advisory http://www.macromedia.com/devnet/security/security_zone/mpsb04-01.html Source: CCN Type: OSVDB ID: 3752 ColdFusion MX Java Reflections Sandbox Bypass Source: BID Type: Patch 9521 Source: CCN Type: BID-9521 Macromedia ColdFusion MX Security Sandbox Circumvention Vulnerability Source: XF Type: UNKNOWN coldfusion-mx-sandbox-bypass(14984) Source: XF Type: UNKNOWN coldfusion-mx-sandbox-bypass(14984) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||