How severe is CVE-2000-0189?

CVE-2000-0189 has a CVSS 2.0 base score of 5.0, rated medium severity.

Is CVE-2000-0189 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (78th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2000-0189?

CVE-2000-0189 primarily affects Allaire Coldfusion Server. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2000-0189?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2000-0189 published?

CVE-2000-0189 was published on 2000-03-01 and last updated on 2026-06-16.

CVE-2000-0189

CVE-2000-0189 is a medium-severity vulnerability in Allaire Coldfusion Server with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 2.0 base score 5.0)
EPSS exploit prediction: 2% (78th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Allaire Coldfusion Server
Published: 2000-03-01
Last modified: 2026-06-16

Description

ColdFusion Server 4.x allows remote attackers to determine the real pathname of the server via an HTTP request to the application.cfm or onrequestend.cfm files.

Frequently asked questions

What is CVE-2000-0189?: ColdFusion Server 4.x allows remote attackers to determine the real pathname of the server via an HTTP request to the application.cfm or onrequestend.cfm files.
How severe is CVE-2000-0189?: CVE-2000-0189 has a CVSS 2.0 base score of 5.0, rated medium severity.
Is CVE-2000-0189 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (78th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2000-0189?: CVE-2000-0189 primarily affects Allaire Coldfusion Server. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2000-0189?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2000-0189 published?: CVE-2000-0189 was published on 2000-03-01 and last updated on 2026-06-16.

References

http://www.securityfocus.com/bid/1021

Affected products (3)

cpe:2.3:a:allaire:coldfusion_server:4.0:*:*:*:*:*:*:*
cpe:2.3:a:allaire:coldfusion_server:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:allaire:coldfusion_server:4.5:*:*:*:*:*:*:*

More vulnerabilities in Allaire Coldfusion Server

CVE-1999-0760 — Critical (CVSS 10.0): Undocumented ColdFusion Markup Language (CFML) tags and functions in the ColdFusion Administrator allow users to gain…
CVE-1999-0923 — High (CVSS 7.5): Sample runnable code snippets in ColdFusion Server 4.0 allow remote attackers to read files, conduct a denial of…
CVE-2000-0057 — High (CVSS 7.5): Cold Fusion CFCACHE tag places temporary cache files within the web document root, allowing remote attackers to obtain…
CVE-1999-0477 — High (CVSS 7.5): The Expression Evaluator in the ColdFusion Application Server allows a remote attacker to upload files to the server…
CVE-1999-0455 — High (CVSS 7.5): The Expression Evaluator sample application in ColdFusion allows remote attackers to read or delete files on the server…
CVE-2001-1120 — Medium (CVSS 6.4): Vulnerabilities in ColdFusion 2.0 through 4.5.1 SP 2 allow remote attackers to (1) read or delete arbitrary files, or…

All CVEs affecting Allaire Coldfusion Server →