CVE-2018-7486 is a critical vulnerability affecting Blue River Mura CMS versions prior to 7.0.7029. It allows remote attackers to execute arbitrary code by leveraging an inline function call feature ([m] tag) to include ColdFusion Markup Language code from an uploaded file, often facilitated by a CKFinder file upload feature. The vulnerability has a CVSS v3.0 score of 7.2 (HIGH), indicating a high-impact threat with complete compromise of confidentiality, integrity, and availability. It requires high privileges (PR:H) but has low attack complexity (AC:L) and no user interaction (UI:N). Currently, there is no evidence of active exploitation (KEV: No), nor are there public Metasploit, Nuclei, or ExploitDB modules available. The vulnerability has also received minimal community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 7.0.7029CPE matchmatch criteria | cpe:2.3:a:blueriver:muracms:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.