{"api_version":"1","generated_at":"2026-07-23T04:30:43+00:00","cve":"CVE-2007-1874","urls":{"html":"https://cve.report/CVE-2007-1874","api":"https://cve.report/api/cve/CVE-2007-1874.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-1874","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-1874"},"summary":{"title":"CVE-2007-1874","description":"Adobe ColdFusion MX 7 for Linux and Solaris uses insecure permissions for certain scripts and directories, which allows local users to execute arbitrary code or obtain sensitive information via the (1) CFMX7DreamWeaverExtensions.mxp, (2) CFReportBuilderInstaller.exe, (3) .com.zerog.registry.xml, (4) uninstall.lax, (5) license.txt, (6) Readme.htm, (7) .com.zerog.registry.xml, (8) k2adminstop, or (9) k2adminstart files; or (10) certain files in lib/wsconfig/.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-04-11 22:19:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.2","severity":"","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","baseScore":7.2,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://www.adobe.com/support/security/bulletins/apsb07-08.html","name":"http://www.adobe.com/support/security/bulletins/apsb07-08.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Adobe - Security Advisories : Workaround available for Linux and Solaris ColdFusion MX 7 file permissions vulnerability","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1017899","name":"http://www.securitytracker.com/id?1017899","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Macromedia ColdFusion Unsafe Directory Permissions Lets Local Users Gain Root Privileges - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/23405","name":"http://www.securityfocus.com/bid/23405","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Adobe Macromedia ColdFusion Insecure File Permissions Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/24850","name":"http://secunia.com/advisories/24850","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Adobe ColdFusion MX Insecure Directory and File Permissions - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/34930","name":"http://osvdb.org/34930","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=510","name":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=510","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2007/1341","name":"http://www.vupen.com/english/advisories/2007/1341","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33571","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33571","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-1874","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-1874","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"1874","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"adobe","cpe5":"coldfusion","cpe6":"7.0","cpe7":"*","cpe8":"linux","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"1874","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"adobe","cpe5":"coldfusion","cpe6":"7.0","cpe7":"*","cpe8":"solaris","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T13:13:41.651Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"ADV-2007-1341","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/1341"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.adobe.com/support/security/bulletins/apsb07-08.html"},{"name":"20070410 Adobe Macromedia ColdFusion MX7 Insecure File Permissions Vulnerability","tags":["third-party-advisory","x_refsource_IDEFENSE","x_transferred"],"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=510"},{"name":"23405","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/23405"},{"name":"24850","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/24850"},{"name":"coldfusion-verity-privilege-escalation(33571)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33571"},{"name":"1017899","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1017899"},{"name":"34930","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/34930"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-04-11T00:00:00.000Z","descriptions":[{"lang":"en","value":"Adobe ColdFusion MX 7 for Linux and Solaris uses insecure permissions for certain scripts and directories, which allows local users to execute arbitrary code or obtain sensitive information via the (1) CFMX7DreamWeaverExtensions.mxp, (2) CFReportBuilderInstaller.exe, (3) .com.zerog.registry.xml, (4) uninstall.lax, (5) license.txt, (6) Readme.htm, (7) .com.zerog.registry.xml, (8) k2adminstop, or (9) k2adminstart files; or (10) certain files in lib/wsconfig/."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"ADV-2007-1341","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/1341"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.adobe.com/support/security/bulletins/apsb07-08.html"},{"name":"20070410 Adobe Macromedia ColdFusion MX7 Insecure File Permissions Vulnerability","tags":["third-party-advisory","x_refsource_IDEFENSE"],"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=510"},{"name":"23405","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/23405"},{"name":"24850","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/24850"},{"name":"coldfusion-verity-privilege-escalation(33571)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33571"},{"name":"1017899","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1017899"},{"name":"34930","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/34930"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-1874","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Adobe ColdFusion MX 7 for Linux and Solaris uses insecure permissions for certain scripts and directories, which allows local users to execute arbitrary code or obtain sensitive information via the (1) CFMX7DreamWeaverExtensions.mxp, (2) CFReportBuilderInstaller.exe, (3) .com.zerog.registry.xml, (4) uninstall.lax, (5) license.txt, (6) Readme.htm, (7) .com.zerog.registry.xml, (8) k2adminstop, or (9) k2adminstart files; or (10) certain files in lib/wsconfig/."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"ADV-2007-1341","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/1341"},{"name":"http://www.adobe.com/support/security/bulletins/apsb07-08.html","refsource":"CONFIRM","url":"http://www.adobe.com/support/security/bulletins/apsb07-08.html"},{"name":"20070410 Adobe Macromedia ColdFusion MX7 Insecure File Permissions Vulnerability","refsource":"IDEFENSE","url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=510"},{"name":"23405","refsource":"BID","url":"http://www.securityfocus.com/bid/23405"},{"name":"24850","refsource":"SECUNIA","url":"http://secunia.com/advisories/24850"},{"name":"coldfusion-verity-privilege-escalation(33571)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33571"},{"name":"1017899","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1017899"},{"name":"34930","refsource":"OSVDB","url":"http://osvdb.org/34930"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-1874","datePublished":"2007-04-11T22:00:00.000Z","dateReserved":"2007-04-05T00:00:00.000Z","dateUpdated":"2024-08-07T13:13:41.651Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-04-11 22:19:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","baseScore":7.2,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":3.9,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:adobe:coldfusion:7.0:*:linux:*:*:*:*:*","matchCriteriaId":"DB570811-F637-4E86-8A0E-73F2F9B29126"},{"vulnerable":true,"criteria":"cpe:2.3:a:adobe:coldfusion:7.0:*:solaris:*:*:*:*:*","matchCriteriaId":"7424F3BC-B8A0-4A45-8E36-16A10D0AD745"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"1874","Ordinal":"1","Title":"CVE-2007-1874","CVE":"CVE-2007-1874","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"1874","Ordinal":"1","NoteData":"Adobe ColdFusion MX 7 for Linux and Solaris uses insecure permissions for certain scripts and directories, which allows local users to execute arbitrary code or obtain sensitive information via the (1) CFMX7DreamWeaverExtensions.mxp, (2) CFReportBuilderInstaller.exe, (3) .com.zerog.registry.xml, (4) uninstall.lax, (5) license.txt, (6) Readme.htm, (7) .com.zerog.registry.xml, (8) k2adminstop, or (9) k2adminstart files; or (10) certain files in lib/wsconfig/.","Type":"Description","Title":"CVE-2007-1874"},{"CveYear":"2007","CveId":"1874","Ordinal":"2","NoteData":"2007-04-11","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"1874","Ordinal":"3","NoteData":"2017-07-28","Type":"Other","Title":"Modified"}]}}}