CVE-2019-7839

Name of the Vulnerable Software and Affected Versions ColdFusion versions Update 3 and earlier ColdFusion versions Update 10 and earlier ColdFusion versions Update 18 and earlier

Description The issue is related to a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. The vulnerability is also associated with a lack of data sanitization at the management level, which could allow a remote attacker to execute arbitrary code.

Recommendations For ColdFusion versions Update 3 and earlier, update to a version later than Update 3 to resolve the issue. For ColdFusion versions Update 10 and earlier, update to a version later than Update 10 to resolve the issue. For ColdFusion versions Update 18 and earlier, update to a version later than Update 18 to resolve the issue. As a temporary workaround, consider restricting access to management-level functions to minimize the risk of exploitation.