Adobe ColdFusion 2016 Update 10/2018 Update 3/up to 11 Update 18 command injection

Summaryinfo

A vulnerability was found in Adobe ColdFusion 2016 Update 10/2018 Update 3/up to 11 Update 18. It has been classified as critical. The affected element is an unknown function. This manipulation causes command injection. This vulnerability is handled as CVE-2019-7839. The attack can be initiated remotely. There is not any exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability classified as critical was found in Adobe ColdFusion 2016 Update 10/2018 Update 3/up to 11 Update 18 (Programming Language Software). Affected by this vulnerability is an unknown code block. The manipulation with an unknown input leads to a command injection vulnerability. The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

The weakness was released 06/11/2019 as APSB19-27 as confirmed security bulletin (Website). It is possible to read the advisory at helpx.adobe.com. This vulnerability is known as CVE-2019-7839 since 02/12/2019. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 371836 (Adobe Security Update for ColdFusion (APSB19-27)).

Applying the patch 11 Update 19/2016 Update 11/2018 Update 4 is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Entries connected to this vulnerability are available at VDB-136350 and VDB-136352. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Adobe

Name

• ColdFusion

Version

• 2016 Update 10
• 2018 Update 3
• <=11 Update 18

License

• commercial

Website

• Vendor: https://www.adobe.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion