CVE-2019-7840

Name of the Vulnerable Software and Affected Versions ColdFusion versions Update 3 and earlier ColdFusion versions Update 10 and earlier ColdFusion versions Update 18 and earlier

Description The issue is related to the deserialization mechanism of the ColdFusion platform, which has shortcomings. This can be exploited by a remote attacker to execute arbitrary code.

Recommendations For ColdFusion versions Update 3 and earlier, consider disabling the deserialization of untrusted data as a temporary workaround until a patch is available. For ColdFusion versions Update 10 and earlier, restrict access to the deserialization mechanism to minimize the risk of exploitation. For ColdFusion versions Update 18 and earlier, avoid using the deserialization of untrusted data in the affected API endpoints until the issue is resolved.