The version of Adobe ColdFusion installed on the remote Windows host is prior to 11.x update 19, 2016.x update 11, or 2018.x update 4. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB19-27 advisory.

  - File extension blacklist bypass potentially leading to Arbitrary code execution (CVE-2019-7838)

  - Command Injection potentially leading to Arbitrary code execution (CVE-2019-7839)

  - Deserialization of untrusted data potentially leading to Arbitrary code execution (CVE-2019-7840)

Nessus はこの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

検出

Adobe ColdFusion < 11.x < 11u19 / 2016.x < 2016u11 / 2018.x < 2018u4 Multiple Vulnerabilities (APSB19-27)

critical Nessus プラグイン ID 125880

変更ログが見つかりません