Unscored severity · published Dec 19, 2005
CVE-2005-4342
ColdFusion Sandbox on Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 does not throw an exception if the SecurityManager is disabled, which might allow…
–
CVSS
1.7%
EPSS
No
On KEV
Description
ColdFusion Sandbox on Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 does not throw an exception if the SecurityManager is disabled, which might allow remote attackers to "bypass security controls," aka "JRun Clustered Sandbox Security Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Coldfusion · Macromedia
6.0; 6.1; 6.1; 6.1; 7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-4342
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-4342
Patch
http://secunia.com/advisories/18078
Patch
http://securitytracker.com/id?1015369
Patch
http://www.macromedia.com/devnet/security/security_zone/mpsb05-12.html
Patch
http://www.macromedia.com/devnet/security/security_zone/mpsb05-14.html
Patch
http://www.securityfocus.com/bid/15904
www.vupen.com
http://www.vupen.com/english/advisories/2005/2948
More from Coldfusion
5.5
CVE-2004-2331
ColdFusion MX 6.1 and 6.1 J2EE allows local users to bypass sandbox security restrictions and obtain sensitive information by using Java reflection methods to access trusted Java…
–
CVE-2006-3979
The AdminAPI of ColdFusion MX 7 allows attackers to bypass authentication by using "programmatic access" to the adminAPI instead of the ColdFusion Administrator
–
CVE-2006-2364
Cross-site scripting (XSS) vulnerability in the validation feature in Macromedia ColdFusion 5 and earlier allows remote attackers to inject arbitrary web script or HTML via a…
–
CVE-2005-4343
Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 allows remote attackers to attach arbitrary files and send mail via a crafted Subject field, which is…
–
CVE-2005-4345
Adobe (formerly Macromedia) ColdFusion MX 7.0 exposes the password hash of the Administrator in an API call, which allows local developers to obtain the hash and gain privileges