CVE-2018-15959 is a critical deserialization of untrusted data vulnerability affecting Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier. With a CVSS score of 9.8, this vulnerability allows for arbitrary code execution with low attack complexity and no user interaction required. While no public exploit intelligence like Metasploit or ExploitDB entries are available, the vulnerability has garnered community discussion and media coverage, though it is not currently listed on the CISA KEV catalog or Hot List.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
11.0CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:11.0:-:*:*:*:*:*:* | ||
11.0CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:11.0:update1:*:*:*:*:*:* | ||
11.0CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:11.0:update10:*:*:*:*:*:* | ||
11.0CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:11.0:update11:*:*:*:*:*:* | ||
11.0CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:11.0:update12:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.