CVE-2018-15961
CVE-2018-15961
In short
Adobe ColdFusion allows attackers to upload files without proper restrictions, potentially leading to malicious code execution on the server. This is a critical flaw because it can give attackers complete control over the affected system.
Technical detail
An unrestricted file upload vulnerability (CWE-434) in Adobe ColdFusion enables attackers to bypass upload validation controls and execute arbitrary code on the server. Exploitation requires network access to the upload functionality; successful code execution compromises the entire application and underlying system integrity.
Summary generated and translated by AI from the official description.
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Adobe · ColdFusionpublic PoCs found — 7
githubgithub.com/vah13/CVE-2018-15961★ 9githubgithub.com/xbufu/CVE-2018-15961★ 3githubgithub.com/orangmuda/CVE-2018-15961★ 2githubgithub.com/cved-sources/cve-2018-15961★ 1githubgithub.com/bu1xuan2/CVE-2018-15961★ 0cve_referencewww.exploit-db.com/exploits/45979/unverifiedexploitdbwww.exploit-db.com/exploits/45979unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →