CVE-2005-4722: _Request_Message.cfm in tmsPUBLISHER 3.3 allows remote attackers to obtain sensitive information via an inv...

Security readout for executives and security teams

This is an old information disclosure issue in tmsPUBLISHER 3.3. A malformed request can make the application reveal its server installation path in an error message. That is not direct compromise, but it can help attackers map the environment and support later attacks. Exposure is likely limited to organizations still running publicly reachable tmsPUBLISHER 3.3 or archived ColdFusion-era deployments. The affected inventory data in the bundle is incomplete, so confirm through asset discovery rather than product assumptions. Treat this as a low-urgency legacy exposure check unless tmsPUBLISHER is internet-facing or unsupported. The main risk is reconnaissance value, so prioritize inventory, error suppression, and retirement of obsolete deployments. Mitigation focus: Identify any active or archived tmsPUBLISHER 3.3 deployments.; Check vendor or maintainer security guidance before changing application code.; Disable detailed production error messages that expose filesystem paths..

Prepared

Jun 29, 2026, 14:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.