9.8Kritisch
KEV
CVE-2017-3066Adobe ColdFusion Deserialization Vulnerability
Bekannt ausgenutzt — Adobe ColdFusion Deserialization Vulnerability
CISA hat am 24.02.2025 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 17.03.2025.
Erforderliche Maßnahme: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html ; https://nvd.nist.gov/vuln/detail/CVE-2017-3066
Beschreibung
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.
Schwachstellentyp (CWE):
CWE-502
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| adobe | coldfusion | 10.0 | |
| — | Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier | Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier |
Referenzen und Patches
- 43993 exploitExploitThird Party AdvisoryVDB Entry
- https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html PatchVendor Advisory
- 98003 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 1038364 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3066 US Government Resource
CPE-Treffer (NVD) (39)
cpe:2.3:a:adobe:coldfusion:10.0:-:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update1:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update10:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update11:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update12:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update13:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update14:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update15:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update16:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update17:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update18:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update19:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update2:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update20:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update21:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update22:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update3:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update4:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update5:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update6:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update7:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update8:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:update9:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:11.0:-:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:11.0:update1:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:11.0:update10:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:11.0:update11:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:11.0:update2:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:11.0:update3:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:11.0:update4:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:11.0:update5:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:11.0:update6:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:11.0:update7:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:11.0:update8:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:11.0:update9:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2016:-:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2016:update1:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2016:update2:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2016:update3:*:*:*:*:*:*