CVE-2001-1514 | BDVDB-2026-11418 Detail

Description#

ColdFusion 4.5 and 5, when running on Windows with the advanced security sandbox type set to "operating system," does not properly pass security context to (1) child processes created with <CFEXECUTE> and (2) child processes that call the CreateProcess function and are executed with <CFOBJECT> or end with the CFX extension, which allows attackers to execute programs with the permissions of the System account.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12005-07-14Record published in the CVE List.
2. Version 22024-09-16Most recent update recorded in the CVE List.