CVEvulnerability

CVE-2004-2331

5.5 MEDIUM Published 2004-12-31 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2004-12-31
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-470

Description

ColdFusion MX 6.1 and 6.1 J2EE allows local users to bypass sandbox security restrictions and obtain sensitive information by using Java reflection methods to access trusted Java objects without using the CreateObject function or cfobject tag.

Affected configurations

• macromedia coldfusion 6.1

Related

Weakness · CWE (1)

  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code weakness

Referenced by CWE · observed example (2)

  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code weakness
  • CWE-610 Externally Controlled Reference to a Resource in Another Sphere weakness

References