The version of Adobe ColdFusion installed on the remote Windows host is prior to 2016.x update 12 or 2018.x update 5. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB19-47 advisory:

 - An unspecified command injection vulnerability via a vulnerable component could allow arbitrary code execution. (CVE-2019-8073)

 - An unspecified path traversal vulnerability could allow access controls to be bypassed. (CVE-2019-8074)

 - An unspecified security bypass vulnerability could allow the disclosure of potentially sensitive information. (CVE-2019-8072)

Nessus はこの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

検出

Adobe ColdFusion 2016.x < 2016u12 / 2018.x < 2018u5 Multiple Vulnerabilities (APSB19-47)

critical Nessus プラグイン ID 129388

変更ログが見つかりません