Actively exploited · Published Sep 25, 2018 · Assigned by adobe
CVE-2018-15961
Critical 9.8 Exploited
In plain English
A critical-severity unrestricted file upload in ColdFusion from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | ColdFusion | July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier versions |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html x_refsource_CONFIRM
- 105314 vdb-entry, x_refsource_BID
- 1041621 vdb-entry, x_refsource_SECTRACK
- 45979 exploit, x_refsource_EXPLOIT-DB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15961 government-resource