Test ID:	1.3.6.1.4.1.25623.1.0.804445
Category:	Web application abuses
Title:	Adobe ColdFusion Multiple Vulnerabilities (APSB13-03)
Summary:	Adobe ColdFusion is prone to multiple vulnerabilities.
Description:	Summary: Adobe ColdFusion is prone to multiple vulnerabilities. Vulnerability Insight: Multiple flaws are due to: - The CFIDE/componentutils/cfcexplorer.cfc script not properly sanitizing user input, specifically directory traversal attacks supplied via the 'path' parameter when 'method' is set to:'getcfcinhtml' and 'name' is set to 'CFIDE.adminapi.administrator'. - The 'ScheduledURL' variable allows specifying an arbitrary resource to save to system as specified by the 'publish_file' variable and then schedule this task to be executed at a set time. Vulnerability Impact: Successful exploitation will allow attackers to disclose the contents of arbitrary files on the system and execute arbitrary code. Affected Software/OS: Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10. Solution: Apply the patch from the referenced advisory. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-0625 BugTraq ID: 57164 http://www.securityfocus.com/bid/57164 Common Vulnerability Exposure (CVE) ID: CVE-2013-0629 BugTraq ID: 57165 http://www.securityfocus.com/bid/57165
Copyright	Copyright (C) 2014 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.