A vulnerability was found in Allaire Coldfusion Server (version now known) and classified as problematic. Affected by this issue is some unknown processing of the component CFCRYPT. The manipulation with an unknown input leads to a missing encryption vulnerability. Using CWE to declare the problem leads to CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. Impacted is confidentiality. CVE summarizes:

The ColdFusion CFCRYPT program for encrypting CFML templates has weak encryption, allowing attackers to decrypt the templates.

The weakness was shared 03/12/2001 as ASB99-08 as confirmed advisory (Website). The advisory is shared for download at allaire.com. This vulnerability is handled as CVE-1999-0757. The exploitation is known to be easy. The attack needs to be approached locally. No form of authentication is required for exploitation. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1600.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (2208), Exploit-DB (19220) and SecurityFocus (BID 275†). The entries VDB-16486 and VDB-16483 are related to this item. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Allaire

Name

• Coldfusion Server

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion