CVE-2019-7840: Critical severity adobe coldfusion vulnerability

Published Jun 12, 2019

Updated

ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.

Affected Software

34 affected components

Adobe ColdFusion=11.0

Adobe ColdFusion=11.0-update1

Adobe ColdFusion=11.0-update10

Adobe ColdFusion=11.0-update11

Adobe ColdFusion=11.0-update12

Adobe ColdFusion=11.0-update13

Adobe ColdFusion=11.0-update14

Adobe ColdFusion=11.0-update15

Adobe ColdFusion=11.0-update16

Adobe ColdFusion=11.0-update17

Adobe ColdFusion=11.0-update18

Adobe ColdFusion=11.0-update2

Adobe ColdFusion=11.0-update3

Adobe ColdFusion=11.0-update4

Adobe ColdFusion=11.0-update5

Adobe ColdFusion=11.0-update6

Adobe ColdFusion=11.0-update7

Adobe ColdFusion=11.0-update8

Adobe ColdFusion=11.0-update9

Adobe ColdFusion=2016

Adobe ColdFusion=2016-update1

Adobe ColdFusion=2016-update10

Adobe ColdFusion=2016-update2

Adobe ColdFusion=2016-update3

Adobe ColdFusion=2016-update4

Adobe ColdFusion=2016-update5

Adobe ColdFusion=2016-update6

Adobe ColdFusion=2016-update7

Adobe ColdFusion=2016-update8

Adobe ColdFusion=2016-update9

Adobe ColdFusion=2018

Adobe ColdFusion=2018-update1

Adobe ColdFusion=2018-update2

Adobe ColdFusion=2018-update3

Event History

Jun 12, 2019

CVE Published

via MITRE·03:14 PM

Data Sourced

via MITRE·03:14 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2019-7840?

CVE-2019-7840 is a vulnerability in ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier, which allows for deserialization of untrusted data and could lead to arbitrary code execution.

What is the severity of CVE-2019-7840?

The severity of CVE-2019-7840 is critical with a CVSS score of 9.8.

What software versions are affected by CVE-2019-7840?

ColdFusion versions 11.0, 2016, and 2018 with various updates are affected by CVE-2019-7840.

How can CVE-2019-7840 be exploited?

CVE-2019-7840 can be exploited by an attacker utilizing deserialization of untrusted data to execute arbitrary code.

Is there a fix for CVE-2019-7840?

Yes, Adobe has released security updates to address CVE-2019-7840. It is recommended to upgrade to the latest version of ColdFusion to mitigate this vulnerability.