CVE-2018-4939criticalunder attackCWE-502

CVE-2018-4939: critical vulnerability in Adobe ColdFusion ColdFusion Update 5 and…

Published · Updated

70Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 62%
from disclosure to weapon
Published on NVDMay 19
CISA KEV+1264d
exploitation probability
62%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

Adobe ColdFusion versions up to Update 5 (2016) and Update 13 (2011) allow attackers to execute arbitrary code by sending specially crafted serialized data. This happens because the application deserializes untrusted input without proper validation.

Technical detail

CWE-502 deserialization vulnerability in Adobe ColdFusion allows remote code execution via malicious serialized objects. The attack vector is network-based with no authentication required; exploitation involves sending crafted serialized data that triggers arbitrary code execution during deserialization. Impact is critical as it grants full system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Adobe ColdFusion ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions
References
https://helpx.adobe.com/security/products/coldfusion/apsb18-14.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4939http://www.securityfocus.com/bid/103718