CVE-2014-5468 is a critical File Inclusion vulnerability affecting Railo 4.2.1 and earlier, allowing remote attackers to include malicious PNG files via a specially crafted URL to thumbnail.cfm. This vulnerability carries a high CVSS score of 8.8, indicating a severe risk of sensitive information disclosure or arbitrary code execution with low attack complexity and no user interaction required. While not listed in CISA's KEV catalog, a Metasploit module exists, confirming exploitability, though there is no evidence of active exploitation or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 4.2.1.000CPE matchmatch criteria | cpe:2.3:a:getrailo:railo:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.