Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
ColdFusion Arbitrary File Upload - Vulnerability Database

ColdFusion Arbitrary File Upload

Description

ColdFusion allows an unauthenticated user to upload arbitrary files. An attacker can exploit it to achieve remote code execution.

Remediation

Upgrade to the latest version of ColdFusion

References

APSB18-33
Active Exploitation of Newly Patched ColdFusion Vulnerability (CVE-2018-15961)

Related Vulnerabilities

PHP unspecified remote arbitrary file upload vulnerability Medium
Common tags: Unauthenticated File Upload
WordPress Plugin Wallable-Social Networking Arbitrary File Upload (1.1) High
Common tags: Unauthenticated File Upload
WordPress Plugin WP Live Chat Support Pro Arbitrary File Upload (8.0.06) High
Common tags: Unauthenticated File Upload
WordPress Plugin MapSVG Lite Arbitrary File Upload (4.0.5) High
Common tags: Unauthenticated File Upload
WordPress Plugin Peugeot Music Arbitrary File Upload (1.0) High
Common tags: Unauthenticated File Upload

Severity

High

Classification

CVE-2018-15961
CWE-434
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Unauthenticated File Upload