⚠️ CISA Known Exploited Vulnerability
Active ThreatThis vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Active exploitation has been observed in the wild. This poses significant risk to federal enterprises and should be prioritized for immediate patching.
CVE-2018-4939
Critical CISA KEVVulnerability Description
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Known Affected Software
2 configuration(s) from 1 vendor(s)
cpe:2.3:a:adobe:coldfusion:2016:update1:*:*:*:*:*:*
cpe:2.3:a:adobe:coldfusion:11.0:update1:*:*:*:*:*:*
References & Resources
-
http://www.securityfocus.com/bid/103718psirt@adobe.com Third Party Advisory VDB Entry
-
https://helpx.adobe.com/security/products/coldfusion/apsb18-14.htmlpsirt@adobe.com Vendor Advisory
-
http://www.securityfocus.com/bid/103718af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory VDB Entry
-
https://helpx.adobe.com/security/products/coldfusion/apsb18-14.htmlaf854a3a-2127-422b-91ae-364da2661108 Vendor Advisory
-
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4939134c704f-9b21-4f2e-91b3-4a467353bcc0 Third Party Advisory US Government Resource
Severity Details
CISA KEV Status
Listed in CISA's Known Exploited Vulnerabilities catalog
Key Information
- Published Date
- May 19, 2018
