CVE-2017-3066: Adobe ColdFusion Deserialization Vulnerability
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.
Other sources
Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Discontinue use of Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, and ColdFusion 10 Update 22 and earlier if vendor mitigations are unavailable.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3066?
CVE-2017-3066 is classified as critical due to its potential for arbitrary code execution.
How do I fix CVE-2017-3066?
To mitigate CVE-2017-3066, update Adobe ColdFusion to a version that has addressed this vulnerability.
Which versions of Adobe ColdFusion are affected by CVE-2017-3066?
CVE-2017-3066 affects Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, and ColdFusion 10 Update 22 and earlier.
What can attackers achieve through CVE-2017-3066?
Successful exploitation of CVE-2017-3066 could allow attackers to execute arbitrary code on the affected system.
Is there a workaround for CVE-2017-3066 if I cannot update?
While a specific workaround for CVE-2017-3066 is not provided, limiting access to the affected services can help reduce the risk until an update is applied.