PT-2019-6050 · Adobe · Coldfusion

Published 2019-06-12 · Updated 2020-09-04 · CVE-2019-7840

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ColdFusion versions Update 3 and earlier ColdFusion versions Update 10 and earlier ColdFusion versions Update 18 and earlier

Description The issue is related to the deserialization mechanism of the ColdFusion platform, which has shortcomings. This can be exploited by a remote attacker to execute arbitrary code.

Recommendations For ColdFusion versions Update 3 and earlier, consider disabling the deserialization of untrusted data as a temporary workaround until a patch is available. For ColdFusion versions Update 10 and earlier, restrict access to the deserialization mechanism to minimize the risk of exploitation. For ColdFusion versions Update 18 and earlier, avoid using the deserialization of untrusted data in the affected API endpoints until the issue is resolved.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2021-04368

CVE-2019-7840

Affected Products

Coldfusion

References · 4

• https://bdu.fstec.ru/vul/2021-04368 · Security Note
• https://helpx.adobe.com/security/products/coldfusion/apsb19-27.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7840 · Security Note
• https://osv.dev/vulnerability/CVE-2019-7840 · Vendor Advisory