| Package | Affected versions | Patched versions |
|---|---|---|
| coldfusion server | = 4.0= 4.5= 5.0 |
ColdFusion 5.0 and earlier on Windows systems allows remote attackers to determine the absolute pathname of .cfm or .dbm files via an HTTP request that contains an MS-DOS device name such as NUL, which leaks the pathname in an error message.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free