Description

ColdFusion FlashGateway is vulnerable to deserialization attacks. An attacker could exploit this vulnerability using specially-crafted serialized data to execute arbitrary code on the system.

Remediation

Upgrade to the latest version of ColdFusion

References

APSB19-10

Related Vulnerabilities

WordPress Plugin CM Download Manager Code Injection (2.0.3)

WordPress Plugin Statistics Remote Code Execution (1.8)

Spring Data REST RCE via PATCH requests

Drupal REST Remote Code Execution

WordPress Plugin Groundhogg-Marketing Automation & CRM for WordPress Remote Code Execution (1.3.4)

Severity

High

Classification

CVE-2019-7091 CWE-502 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution Insecure Deserialization Acumonitor