CVE-2004-2204: Macromedia ColdFusion

High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days.

Macromedia ColdFusion MX 6.0 and 6.1 application server, when running with the CreateObject function or CFOBJECT tag enabled, allows local users to conduct unauthorized activities and obtain administrative passwords by creating CFML scripts that use CreateObject or CFOBJECT.

Affected products

• Macromedia ColdFusion: version 6.0 only; version 6.1 only

Published 2004-12-31. Last modified 2026-06-16.