Description

ColdFusion allows an unauthenticated user to connect to any LDAP server. An attacker can exploit it to achieve remote code execution.

Remediation

Upgrade to the latest version of ColdFusion.

References

APSB18-33

A Journey From JNDI/LDAP Manipulation To RCE

Related Vulnerabilities

Rails remote code execution using render :inline

GlobalProtect PAN-OS RCE (CVE-2024-3400)

WordPress Plugin WP-Filebase Download Manager Remote Code Execution (0.3.0.03)

Drupal Core 5.x Arbitrary Code Execution (5.0)

WordPress Plugin WP Super Cache PHP Code Injection (1.2)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution Acumonitor CWE-502 CVE-2018-15957