CVE-2014-5468

Name of the Vulnerable Software and Affected Versions Railo versions 4.2.1 and earlier

Description A File Inclusion issue exists, allowing a remote malicious user to obtain sensitive information or execute arbitrary code via a specially-crafted URL request to the thumbnail.cfm endpoint, specifying a malicious PNG file.

Recommendations For versions 4.2.1 and earlier, as a temporary workaround, consider restricting access to the thumbnail.cfm endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.