CVE-2005-4345

HighCVSS 7.2/10Last modified Jun 16, 2026

Description

Adobe (formerly Macromedia) ColdFusion MX 7.0 exposes the password hash of the Administrator in an API call, which allows local developers to obtain the hash and gain privileges.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/18078Patch, Vendor Advisory
http://securitytracker.com/id?1015371Patch, Vendor Advisory
http://www.macromedia.com/devnet/security/security_zone/mpsb05-14.htmlPatch
http://www.securityfocus.com/bid/15904Patch
http://www.vupen.com/english/advisories/2005/2948
http://secunia.com/advisories/18078Patch, Vendor Advisory
http://securitytracker.com/id?1015371Patch, Vendor Advisory
http://www.macromedia.com/devnet/security/security_zone/mpsb05-14.htmlPatch
http://www.securityfocus.com/bid/15904Patch
http://www.vupen.com/english/advisories/2005/2948

Timeline

Published: Dec 19, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-43465.0Invalid SQL syntax error in blog.php in phpBB Blog 2.2.2 and earlier allows remote attackers to obtain the full path of the application via CVE-2005-43475.0The Linux 2.4 kernel patch in kernel-patch-vserver before 1.9.5.5 and 2.x before 2.3 for Debian GNU/Linux does not correctly set the "chroot CVE-2005-43487.8fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (applica CVE-2005-43496.3SQL injection vulnerability in server_privileges.php in phpMyAdmin 2.7.0 allows remote authenticated users to execute arbitrary SQL commands CVE-2005-43507.8Unspecified vulnerability in WBEM Services A.01.x before A.01.05.12 and A.02.x before A.02.00.08 on HP-UX B.11.00 through B.11.23 allows rem CVE-2005-43514.3The securelevels implementation in FreeBSD 7.0 and earlier, OpenBSD up to 3.8, DragonFly up to 1.2, and Linux up to 2.6.15 allows root users CVE-2005-43522.1The securelevels implementation in NetBSD 2.1 and earlier, and Linux 2.6.15 and earlier, allows local users to bypass time setting restricti CVE-2005-43537.5SQL injection vulnerability in index.php in toendaCMS 0.6.2.1, when configured to use a SQL database, allows remote attackers to execute arb CVE-2005-43544.3Cross-site scripting (XSS) vulnerability in webglimpse.cgi in Webglimpse 2.14.1 and earlier allows remote attackers to inject arbitrary web CVE-2005-43554.3Multiple cross-site scripting (XSS) vulnerabilities in UStore allow remote attackers to inject arbitrary web script or HTML via the (1) Cat CVE-2005-43567.5SQL injection vulnerability in UStore allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields CVE-2005-43572.6Cross-site scripting (XSS) vulnerability in phpBB 2.0.18, when "Allowed HTML tags" is enabled, allows remote attackers to inject arbitrary J