CVE-2018-4939 is a critical Deserialization of Untrusted Data vulnerability affecting Adobe ColdFusion Update 5 and earlier, and ColdFusion 11 Update 13 and earlier. With a CVSS score of 9.8, it allows unauthenticated attackers to achieve arbitrary code execution over the network with low attack complexity. This vulnerability is actively exploited in the wild, as confirmed by its presence in the KEV catalog and high EPSS score. Despite no public Metasploit or ExploitDB modules, it has garnered significant community attention and media coverage, including being targeted by state-sponsored actors.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
11.0CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:11.0:-:*:*:*:*:*:* | ||
11.0CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:11.0:update1:*:*:*:*:*:* | ||
11.0CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:11.0:update10:*:*:*:*:*:* | ||
11.0CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:11.0:update11:*:*:*:*:*:* | ||
11.0CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:11.0:update12:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.