EXPOSURES › CVE-2018-15961
CVE-2018-15961
HIGH ⌖ ON CISA KEV · EXPLOITEDAdobe ColdFusion's unrestricted file upload flaw allowed remote code execution, enabling attackers to upload and execute malicious files on vulnerable systems.
The unrestricted file upload vulnerability in Adobe ColdFusion permitted attackers to upload arbitrary files and execute code on the server, leading to full system compromise. DIB organizations must ensure ColdFusion is patched to the latest version and restrict file upload capabilities to prevent similar exploits. This failure highlights the risk of unpatched vulnerabilities and the need for strict input validation in web applications.
Shame score — A known unrestricted file upload flaw was exploited to achieve remote code execution, indicating a failure to patch or secure a critical vulnerability that could have been mitigated with proper updates and access controls.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.
"Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution."
"Adobe ColdFusion is a commercial rapid web application development platform used to build and deploy dynamic web and mobile applications."
| PRODUCT | STATUS |
|---|---|
| Adobe Acrobat Sign for Government Adobe |
Authorized |
| Adobe Analytics Adobe |
Authorized |
| Adobe Campaign Adobe |
Authorized |
| Adobe Connect Managed Services (ACMS-GC) Adobe |
Authorized |
| Adobe Creative Cloud for Enterprise Adobe |
Authorized |
| Adobe Document Cloud (PDF Services & Adobe Sign) Adobe |
Authorized |
| Adobe Experience Manager Managed Services (AEMMS-GC) Adobe |
Authorized |
| Adobe Learning Manager Adobe |
Authorized |