by Kastro
Paper/Archive/CVE-2018-4939

CVE-2018-4939

Adobe ColdFusion — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

KEV · due 3 MayEPSS 62%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.2.992 × 2019.8Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.

Affected

ProductAffectedFixed inSource
Adobe ColdFusion ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versionsAdobe ColdFusion ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refhelpx.adobe.com/security/products/coldfusion/apsb18-14.htmlrefsecurityfocus.com/bid/103718refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4939kevcisa.gov/known-exploited-vulnerabilities-catalog