Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2004-0928: ColdFusion and JRun IIS Connector lets attackers read source files

CVE-2004-0928 · published 22 years ago

Summary

The IIS Connector used by Macromedia ColdFusion MX 6.0, 6.1 (including the J2EE version) and JRun 4.0 can be tricked into skipping the login check and returning the raw code of server scripts such as .asp, .pl, and .php. This means a remote user could see the underlying application logic and potentially exploit it. Apply the vendor's security update or disable the connector and upgrade to a supported version to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
hitachi	cosminexus_enterprise	01_01_1 01_02_2 `cpe:2.3:a:hitachi:cosminexus_enterprise:01_01_1::enterprise:::::`
hitachi	cosminexus_server	web_01-01_1 web_01-01_2 `cpe:2.3:a:hitachi:cosminexus_server:web_01-01_1:::::::*`
macromedia	coldfusion	6.0 6.1 `cpe:2.3:a:macromedia:coldfusion:6.0:::::::*`
macromedia	jrun	3.0 3.1 4.0 `cpe:2.3:a:macromedia:jrun:3.0:::::::*`

Original advisory text

The Microsoft IIS Connector in JRun 4.0 and Macromedia ColdFusion MX 6.0, 6.1, and 6.1 J2EE allows remote attackers to bypass authentication and view source files, such as .asp, .pl, and .php files...

References

http://marc.info/?l=bugtraq&m=109621995623823&w=2
http://secunia.com/advisories/12638/ Patch Vendor Advisory
http://secunia.com/advisories/12647/ Patch Vendor Advisory
http://www.idefense.com/application/poi/display?id=148&type=vulnerabilities Patch Vendor Advisory
http://www.kb.cert.org/vuls/id/977440 Patch Third Party Advisory US Government Resource
http://www.macromedia.com/devnet/security/security_zone/mpsb04-08.html Patch Vendor Advisory
http://www.macromedia.com/devnet/security/security_zone/mpsb04-09.html Patch Vendor Advisory
http://www.securityfocus.com/bid/11245 Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17484

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.0 Medium

Exploitation

4% chance of attack within 30 days

Timeline

Published5 Oct 2004

Updated24 Oct 2026

First seen29 Sep 2026

Sources

CVE-2004-0928 · NVD

Track software like this

Free during beta