Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

ColdFusion Server lets remote attacker upload files

CVE-1999-0477 · published 26 years ago
Summary

ColdFusion Server's expression evaluator can be tricked into using the openfile.cfm page to place files on the web server without proper checks. An attacker could add malicious scripts or data that the server will then run or serve to users. Apply the latest security update from Adobe or block access to openfile.cfm until it is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
allaire coldfusion_server 2.0
3.0
3.01
3.11
3.12
4.0
cpe:2.3:a:allaire:coldfusion_server:2.0:*:*:*:*:*:*:*
Original advisory text
The Expression Evaluator in the ColdFusion Application Server allows a remote attacker to upload files to the server via openfile.cfm, which does not restrict access to the server properly.
The Expression Evaluator in the ColdFusion Application Server allows a remote attacker to upload files to the server via openfile.cfm, which does not restrict access to the server properly.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
5% chance of attack within 30 days
Timeline
Published25 Dec 1999
Updated22 Oct 2026
First seen29 Sep 2026
Sources
CVE-1999-0477 · NVD
Track software like this
Free during beta