9.8

CVE-2024-41874

ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability by providing crafted input to the application, which when deserialized, leads to execution of malicious code. Exploitation of this issue does not require user interaction.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Adobe ≫ Coldfusion Version2023 Update-
Adobe ≫ Coldfusion Version2023 Updateupdate1
Adobe ≫ Coldfusion Version2023 Updateupdate2
Adobe ≫ Coldfusion Version2023 Updateupdate3
Adobe ≫ Coldfusion Version2023 Updateupdate4
Adobe ≫ Coldfusion Version2023 Updateupdate5
Adobe ≫ Coldfusion Version2023 Updateupdate6
Adobe ≫ Coldfusion Version2023 Updateupdate7
Adobe ≫ Coldfusion Version2023 Updateupdate8
Adobe ≫ Coldfusion Version2023 Updateupdate9
Adobe ≫ Coldfusion Version2021 Update-
Adobe ≫ Coldfusion Version2021 Updateupdate1
Adobe ≫ Coldfusion Version2021 Updateupdate10
Adobe ≫ Coldfusion Version2021 Updateupdate11
Adobe ≫ Coldfusion Version2021 Updateupdate12
Adobe ≫ Coldfusion Version2021 Updateupdate13
Adobe ≫ Coldfusion Version2021 Updateupdate14
Adobe ≫ Coldfusion Version2021 Updateupdate15
Adobe ≫ Coldfusion Version2021 Updateupdate2
Adobe ≫ Coldfusion Version2021 Updateupdate3
Adobe ≫ Coldfusion Version2021 Updateupdate4
Adobe ≫ Coldfusion Version2021 Updateupdate5
Adobe ≫ Coldfusion Version2021 Updateupdate6
Adobe ≫ Coldfusion Version2021 Updateupdate7
Adobe ≫ Coldfusion Version2021 Updateupdate8
Adobe ≫ Coldfusion Version2021 Updateupdate9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 23.76% 0.958
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
psirt@adobe.com 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.