How severe is CVE-1999-0455?

CVE-1999-0455 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-1999-0455 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 6% (92nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-1999-0455?

CVE-1999-0455 affects Allaire Coldfusion Server. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-1999-0455?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-1999-0455 published?

CVE-1999-0455 was published on 1999-12-25 and last updated on 2026-06-16.

CVE-1999-0455

CVE-1999-0455 is a high-severity vulnerability in Allaire Coldfusion Server with a CVSS 2.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 2.0 base score 7.5)
EPSS exploit prediction: 6% (92nd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Allaire Coldfusion Server
Published: 1999-12-25
Last modified: 2026-06-16

Description

The Expression Evaluator sample application in ColdFusion allows remote attackers to read or delete files on the server via exprcalc.cfm, which does not restrict access to the server properly.

Frequently asked questions

What is CVE-1999-0455?: The Expression Evaluator sample application in ColdFusion allows remote attackers to read or delete files on the server via exprcalc.cfm, which does not restrict access to the server properly.
How severe is CVE-1999-0455?: CVE-1999-0455 has a CVSS 2.0 base score of 7.5, rated high severity.
Is CVE-1999-0455 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 6% (92nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-1999-0455?: CVE-1999-0455 affects Allaire Coldfusion Server. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-1999-0455?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-1999-0455 published?: CVE-1999-0455 was published on 1999-12-25 and last updated on 2026-06-16.

References

http://www.securityfocus.com/bid/115

Affected products (1)

cpe:2.3:a:allaire:coldfusion_server:4.0:*:*:*:*:*:*:*

More vulnerabilities in Allaire Coldfusion Server

CVE-1999-0760 — Critical (CVSS 10.0): Undocumented ColdFusion Markup Language (CFML) tags and functions in the ColdFusion Administrator allow users to gain…
CVE-1999-0923 — High (CVSS 7.5): Sample runnable code snippets in ColdFusion Server 4.0 allow remote attackers to read files, conduct a denial of…
CVE-2000-0057 — High (CVSS 7.5): Cold Fusion CFCACHE tag places temporary cache files within the web document root, allowing remote attackers to obtain…
CVE-1999-0477 — High (CVSS 7.5): The Expression Evaluator in the ColdFusion Application Server allows a remote attacker to upload files to the server…
CVE-2001-1120 — Medium (CVSS 6.4): Vulnerabilities in ColdFusion 2.0 through 4.5.1 SP 2 allow remote attackers to (1) read or delete arbitrary files, or…
CVE-2002-0576 — Medium (CVSS 5.0): ColdFusion 5.0 and earlier on Windows systems allows remote attackers to determine the absolute pathname of .cfm or…

All CVEs affecting Allaire Coldfusion Server →