Lucene search

K

[email protected]NVD:CVE-2017-3066

HistoryApr 27, 2017 - 2:59 p.m.

CVE-2017-3066

2017-04-2714:59:00

CWE-502

[email protected]

web.nvd.nist.gov

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.91 High

EPSS

Percentile

98.9%

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.

Affected configurations

NVD

Node

adobecoldfusionMatch10.0-

OR

adobecoldfusionMatch10.0update1

OR

adobecoldfusionMatch10.0update10

OR

adobecoldfusionMatch10.0update11

OR

adobecoldfusionMatch10.0update12

OR

adobecoldfusionMatch10.0update13

OR

adobecoldfusionMatch10.0update14

OR

adobecoldfusionMatch10.0update15

OR

adobecoldfusionMatch10.0update16

OR

adobecoldfusionMatch10.0update17

OR

adobecoldfusionMatch10.0update18

OR

adobecoldfusionMatch10.0update19

OR

adobecoldfusionMatch10.0update2

OR

adobecoldfusionMatch10.0update20

OR

adobecoldfusionMatch10.0update21

OR

adobecoldfusionMatch10.0update22

OR

adobecoldfusionMatch10.0update3

OR

adobecoldfusionMatch10.0update4

OR

adobecoldfusionMatch10.0update5

OR

adobecoldfusionMatch10.0update6

OR

adobecoldfusionMatch10.0update7

OR

adobecoldfusionMatch10.0update8

OR

adobecoldfusionMatch10.0update9

OR

adobecoldfusionMatch11.0-

OR

adobecoldfusionMatch11.0update1

OR

adobecoldfusionMatch11.0update10

OR

adobecoldfusionMatch11.0update11

OR

adobecoldfusionMatch11.0update2

OR

adobecoldfusionMatch11.0update3

OR

adobecoldfusionMatch11.0update4

OR

adobecoldfusionMatch11.0update5

OR

adobecoldfusionMatch11.0update6

OR

adobecoldfusionMatch11.0update7

OR

adobecoldfusionMatch11.0update8

OR

adobecoldfusionMatch11.0update9

OR

adobecoldfusionMatch2016-

OR

adobecoldfusionMatch2016update1

OR

adobecoldfusionMatch2016update2

OR

adobecoldfusionMatch2016update3

References

www.securityfocus.com/bid/98003

www.securitytracker.com/id/1038364

helpx.adobe.com/security/products/coldfusion/apsb17-14.html

www.exploit-db.com/exploits/43993/

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.91 High

EPSS

Percentile

98.9%

Related for NVD:CVE-2017-3066

cve1 exploitpack1 cvelist1 attackerkb1 ics1 nessus2 prion1 zdt1 packetstorm1 exploitdb1 talosblog1 openvas1 adobe1 threatpost1 seebug1 impervablog1