CVE-2004-2331

EPSS 0.01%
Veröffentlicht 31.12.2004 05:00:00
Zuletzt bearbeitet 03.04.2025 01:03:51
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

ColdFusion MX 6.1 and 6.1 J2EE allows local users to bypass sandbox security restrictions and obtain sensitive information by using Java reflection methods to access trusted Java objects without using the CreateObject function or cfobject tag.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 7

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Macromedia ≫ Coldfusion Version6.1

Macromedia ≫ Coldfusion Version6.1 Editionj2ee_application_server

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.01%	0.009

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.5	1.8	3.6	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov	2.1	3.9	2.9	AV:L/AC:L/Au:N/C:P/I:N/A:N

CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

http://secunia.com/advisories/10743/

URL Repurposed

http://www.macromedia.com/devnet/security/security_zone/mpsb04-01.html

Patch

Vendor Advisory

http://www.securityfocus.com/bid/9521

Patch

Third Party Advisory

Broken Link

VDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/14984

Third Party Advisory

VDB Entry

https://nvd.nist.gov/vuln/detail/CVE-2004-2331

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2004-2331

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2004-2331

EUVD