Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
ColdFusion JNDI injection RCE - Vulnerability Database

ColdFusion JNDI injection RCE

Description

ColdFusion allows an unauthenticated user to connect to any LDAP server. An attacker can exploit it to achieve remote code execution.

Remediation

Upgrade to the latest version of ColdFusion.

References

APSB18-33
A Journey From JNDI/LDAP Manipulation To RCE

Related Vulnerabilities

Oracle Business Intelligence AMF Deserialization RCE CVE-2020-2950 High
Common tags: Code Execution Acumonitor
Apache Struts2 Remote Command Execution (S2-052) High
Common tags: Code Execution Acumonitor
GhostScript RCE (Remote Code Execution) Critical
Common tags: Code Execution Acumonitor
Code Evaluation (Python) Critical
Common tags: Code Execution Acumonitor
SAP Hybris Deserialization RCE High
Common tags: Code Execution Acumonitor

Severity

High

Classification

CVE-2018-15957
CWE-502
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution
Acumonitor