File Disclosure Vulnerability in Adobe ColdFusion and JRun on Microsoft IIS

CVE-2006-5858

Summary

Adobe ColdFusion MX 7 up to 7.0.2 and JRun 4, when configured on Microsoft IIS, are susceptible to a security vulnerability that permits unauthorized remote attackers to read arbitrary files. This exploitation can occur through a manipulation involving a double URL-encoded NULL byte in the ColdFusion filename, such as that of a CFM file. Consequently, attackers may gain access to sensitive information, including source code and directory structures.

References