Actively exploited · Published May 19, 2018 · Assigned by adobe
CVE-2018-4939
Critical 9.8 Exploited
In plain English
A critical-severity unsafe deserialization in Adobe ColdFusion ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 61.8% (higher than 99.2% of all known vulnerabilities). Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Adobe ColdFusion ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions | Adobe ColdFusion ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://helpx.adobe.com/security/products/coldfusion/apsb18-14.html x_refsource_MISC
- 103718 vdb-entry, x_refsource_BID
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4939 government-resource