PT-2019-5911 · Adobe · Coldfusion

Published 2019-06-12 · Updated 2020-09-04 · CVE-2019-7838

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ColdFusion versions Update 3 and earlier ColdFusion versions Update 10 and earlier ColdFusion versions Update 18 and earlier

Description The issue is related to a file extension blacklist bypass vulnerability, which could allow a remote attacker to execute arbitrary code by exploiting the unlimited upload of dangerous file types. Successful exploitation of this issue may lead to arbitrary code execution.

Recommendations For ColdFusion versions Update 3 and earlier, update to a version later than Update 3 to resolve the issue. For ColdFusion versions Update 10 and earlier, update to a version later than Update 10 to resolve the issue. For ColdFusion versions Update 18 and earlier, update to a version later than Update 18 to resolve the issue.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2021-03785

CVE-2019-7838

Affected Products

Coldfusion

References · 4

• https://helpx.adobe.com/security/products/coldfusion/apsb19-27.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7838 · Security Note
• https://bdu.fstec.ru/vul/2021-03785 · Security Note
• https://osv.dev/vulnerability/CVE-2019-7838 · Vendor Advisory