PT-2019-5977 · Adobe · Coldfusion
Moritz Bechler
·
Publicado
2019-06-11
·
Atualizado
2020-09-04
·
CVE-2019-7839
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
ColdFusion versions Update 3 and earlier
ColdFusion versions Update 10 and earlier
ColdFusion versions Update 18 and earlier
Description
The issue is related to a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. The vulnerability is also associated with a lack of data sanitization at the management level, which could allow a remote attacker to execute arbitrary code.
Recommendations
For ColdFusion versions Update 3 and earlier, update to a version later than Update 3 to resolve the issue.
For ColdFusion versions Update 10 and earlier, update to a version later than Update 10 to resolve the issue.
For ColdFusion versions Update 18 and earlier, update to a version later than Update 18 to resolve the issue.
As a temporary workaround, consider restricting access to management-level functions to minimize the risk of exploitation.
Exploit
Correção
Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Coldfusion