10

CVE-2018-4939

Warnung
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Adobe ≫ Coldfusion Version11.0 Update-
Adobe ≫ Coldfusion Version11.0 Updateupdate1
Adobe ≫ Coldfusion Version11.0 Updateupdate10
Adobe ≫ Coldfusion Version11.0 Updateupdate11
Adobe ≫ Coldfusion Version11.0 Updateupdate12
Adobe ≫ Coldfusion Version11.0 Updateupdate13
Adobe ≫ Coldfusion Version11.0 Updateupdate2
Adobe ≫ Coldfusion Version11.0 Updateupdate3
Adobe ≫ Coldfusion Version11.0 Updateupdate4
Adobe ≫ Coldfusion Version11.0 Updateupdate5
Adobe ≫ Coldfusion Version11.0 Updateupdate6
Adobe ≫ Coldfusion Version11.0 Updateupdate7
Adobe ≫ Coldfusion Version11.0 Updateupdate8
Adobe ≫ Coldfusion Version11.0 Updateupdate9
Adobe ≫ Coldfusion Version2016 Update-
Adobe ≫ Coldfusion Version2016 Updateupdate1
Adobe ≫ Coldfusion Version2016 Updateupdate2
Adobe ≫ Coldfusion Version2016 Updateupdate3
Adobe ≫ Coldfusion Version2016 Updateupdate4
Adobe ≫ Coldfusion Version2016 Updateupdate5

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Schwachstelle

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 76.96% 0.989
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

http://www.securityfocus.com/bid/103718
Third Party Advisory
VDB Entry