ColdFusion <=2023.9 Deserialization RCE (CVE-2024-41874)
CVE-2024-41874 Published on September 13, 2024
ColdFusion | Deserialization of Untrusted Data (CWE-502)
ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability by providing crafted input to the application, which when deserialized, leads to execution of malicious code. Exploitation of this issue does not require user interaction.
Vulnerability Analysis
CVE-2024-41874 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is a Marshaling, Unmarshaling Vulnerability?
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVE-2024-41874 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.
Products Associated with CVE-2024-41874
Want to know whenever a new CVE is published for Adobe ColdFusion? stack.watch will email you.
Affected Versions
Adobe ColdFusion:- Before and including 2021.15 is affected.
- Version 2023.0, <= 2023.9 is affected.
- Version 2021.0, <= 2021.15 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.