Servers and applications
CVE-2007-1874
Adobe ColdFusion MX 7 for Linux and Solaris uses insecure permissions for certain scripts and directories, which allows local users to execute arbitrary code or obtain sensitive information via the (1) CFMX7DreamWeaverExtensions.mxp, (2) CFReportBuilderInstaller.exe, (3) .com.zerog.registry.xml, (4) uninstall.lax, (5) license.txt, (6) Readme.htm, (7) .com.zerog.registry.xml, (8) k2adminstop, or…
- Severity
- High 7.2
- Published
- 11 Apr 2007
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 0.7% in the next 30 daysHigher than 55% of CVEs. EPSS by FIRST, 12 Nov 2026
- Attack
- Needs local access · No login needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
AV:L/AC:L/Au:N/C:C/I:C/A:C- Sources
- NVD
Description
Adobe ColdFusion MX 7 for Linux and Solaris uses insecure permissions for certain scripts and directories, which allows local users to execute arbitrary code or obtain sensitive information via the (1) CFMX7DreamWeaverExtensions.mxp, (2) CFReportBuilderInstaller.exe, (3) .com.zerog.registry.xml, (4) uninstall.lax, (5) license.txt, (6) Readme.htm, (7) .com.zerog.registry.xml, (8) k2adminstop, or (9) k2adminstart files; or (10) certain files in lib/wsconfig/.
Affected software
| Software | Affected versions |
|---|---|
Adobe ColdFusionServers and applications · cpe:a:adobe:coldfusion |
|