CVE Catalog
CVE-2000-0189
MediumExploitation Probability (EPSS)
High risk1.93%
77th percentile - higher than 77% of all known CVEs
Summary
ColdFusion Server 4.x allows remote attackers to determine the real pathname of the server via an HTTP request to the application.cfm or onrequestend.cfm files.
Risk Assessment
Attackers may gain information about the server's file system structure, potentially leading to further attacks on the application or server.
Recommendation
It is recommended to update ColdFusion to the latest version and restrict access to sensitive configuration files.
Original NVD description (English source)
ColdFusion Server 4.x allows remote attackers to determine the real pathname of the server via an HTTP request to the application.cfm or onrequestend.cfm files.