PT-2019-5977 · Adobe · Coldfusion

Moritz Bechler · Published 2019-06-11 · Updated 2020-09-04 · CVE-2019-7839

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ColdFusion versions Update 3 and earlier ColdFusion versions Update 10 and earlier ColdFusion versions Update 18 and earlier

Description The issue is related to a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. The vulnerability is also associated with a lack of data sanitization at the management level, which could allow a remote attacker to execute arbitrary code.

Recommendations For ColdFusion versions Update 3 and earlier, update to a version later than Update 3 to resolve the issue. For ColdFusion versions Update 10 and earlier, update to a version later than Update 10 to resolve the issue. For ColdFusion versions Update 18 and earlier, update to a version later than Update 18 to resolve the issue. As a temporary workaround, consider restricting access to management-level functions to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2021-04057

CVE-2019-7839

Affected Products

Coldfusion

References · 10

• 🔥 https://github.com/securifera/CVE-2019-7839 · Exploit
• https://bdu.fstec.ru/vul/2021-04057 · Security Note
• https://osv.dev/vulnerability/CVE-2019-7839 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7839 · Security Note
• https://helpx.adobe.com/security/products/coldfusion/apsb19-27.html · Vendor Advisory
• http://packetstormsecurity.com/files/153439/Coldfusion-JNBridge-Remote-Code-Execution.html · Note
• https://t.me/malwr/1849 · Telegram Post
• https://t.me/defcon_news/20783 · Telegram Post
• https://seclists.org/bugtraq/2019/Jun/38 · Note
• https://t.me/rnetsec/10106 · Telegram Post