## Description

ColdFusion Server 4.x allows remote attackers to determine the real pathname of the server via an HTTP request to the application.cfm or onrequestend.cfm files.

## Severity

Overall Severity: N/A

### CVSS Metrics

Type | Score | Severity | Vector
--- | --- | --- | ---

## Affected Products

### allaire - coldfusion_server

Affected Versions:

- 4.0

### allaire - coldfusion_server

Affected Versions:

- 4.0.1

### allaire - coldfusion_server

Affected Versions:

- 4.5

## References

- http://www.securityfocus.com/bid/1021
- http://www.securityfocus.com/bid/1021

Neural Processor Active