CyberSec.Space Logo
Back to CVE Browser

CVE-2018-4939

Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
EPSS Score61.0170%
EPSS Percentile87.58th
PublishedMay 19, 2018
Last ModifiedOct 23, 2025

Vulnerability Description

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.

Affected Platforms (CPE)

📦
Adobe

Coldfusion

= 11.0
📦
Adobe

Coldfusion

= 11.0
📦
Adobe

Coldfusion

= 11.0
📦
Adobe

Coldfusion

= 11.0
📦
Adobe

Coldfusion

= 11.0
📦
Adobe

Coldfusion

= 11.0
📦
Adobe

Coldfusion

= 11.0
📦
Adobe

Coldfusion

= 11.0
📦
Adobe

Coldfusion

= 11.0
📦
Adobe

Coldfusion

= 11.0
📦
Adobe

Coldfusion

= 11.0
📦
Adobe

Coldfusion

= 11.0
📦
Adobe

Coldfusion

= 11.0
📦
Adobe

Coldfusion

= 11.0
📦
Adobe

Coldfusion

= 2016
📦
Adobe

Coldfusion

= 2016
📦
Adobe

Coldfusion

= 2016
📦
Adobe

Coldfusion

= 2016
📦
Adobe

Coldfusion

= 2016
📦
Adobe

Coldfusion

= 2016

References & Advisories

🔗 http://www.securityfocus.com/bid/103718
🔗 https://helpx.adobe.com/security/products/coldfusion/apsb18-14.html
🔗 http://www.securityfocus.com/bid/103718
🔗 https://helpx.adobe.com/security/products/coldfusion/apsb18-14.html
🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4939

Related Vulnerabilities

CVE-2001-151410.0

ColdFusion 4.5 and 5, when running on Windows with the advanced security sandbox type set to "operating system," does not properly...

CVE-2010-529010.0

The authentication process in Adobe ColdFusion before 10 does not require knowledge of the cleartext password if the password hash...

CVE-1999-076010.0

Undocumented ColdFusion Markup Language (CFML) tags and functions in the ColdFusion Administrator allow users to gain additional p...

CVE-2013-138910.0

Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 10 before U...