PT-2019-18765 · Adobe · Coldfusion

Published 2019-05-24 · Updated 2020-09-04 · CVE-2019-7816

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ColdFusion versions Update 2 and earlier ColdFusion versions Update 9 and earlier ColdFusion versions Update 17 and earlier

Description The issue allows for a file upload restriction bypass, which could lead to arbitrary code execution if successfully exploited.

Recommendations For ColdFusion versions Update 2 and earlier, update to a version later than Update 2. For ColdFusion versions Update 9 and earlier, update to a version later than Update 9. For ColdFusion versions Update 17 and earlier, update to a version later than Update 17.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-7816

Affected Products

Coldfusion

References · 3

• https://osv.dev/vulnerability/CVE-2019-7816 · Vendor Advisory
• https://helpx.adobe.com/security/products/coldfusion/apsb19-14.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7816 · Security Note