« Back to list

CVE-2019-8073

Status: ModifiedCritical (9.8)—

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Command Injection via Vulnerable component vulnerability. Successful exploitation could lead to Arbitrary code execution in the context of the current user.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Adobe — Coldfusion

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2019-8073",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@adobe.com",
      "affectedData": [
        {
          "vendor": "Adobe",
          "product": "Cold Fusion",
          "versions": [
            {
              "status": "affected",
              "version": "ColdFusion 2018- update 4 and earlier"
            },
            {
              "status": "affected",
              "version": "ColdFusion 2016- update 11 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-09-27T16:15:10.843",
  "references": [
    {
      "url": "https://helpx.adobe.com/security/products/coldfusion/apsb19-47.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@adobe.com"
    },
    {
      "url": "https://helpx.adobe.com/security/products/coldfusion/apsb19-47.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Command Injection via Vulnerable component vulnerability. Successful exploitation could lead to Arbitrary code execution in the context of the current user."
    },
    {
      "lang": "es",
      "value": "ColdFusion 2018 - update 4 y anteriores y ColdFusion 2016 - update 11 y anteriores, presentan una Inyección de Comando por medio de la vulnerabilidad del componente Vulnerable. Su explotación con éxito podría conllevar a la ejecución de código arbitrario en el contexto del usuario actual."
    }
  ],
  "lastModified": "2026-06-17T02:41:26.827",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B262F442-FF7F-4CC0-A9C5-FFD0EDB08E38"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F3D7C8E-6695-44DF-AC9A-1AE09C46C529"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "449A07A6-1D7A-49CF-9316-5EAAFAF38956"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5265059-D9DD-44E6-B68C-81838BCA64C5"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12BAE66C-A745-4661-B5BB-7FC2C169CC82"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6EC92F3-1EF8-4820-9CD8-ECEA03D27A7B"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7446D70-D616-4EC1-BC64-41CDE56EFEAE"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59453B01-EAAF-4291-B2C2-98835F5AFE80"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63076ED8-FC30-40B1-99A7-D0069423A536"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4B4228E-6FBD-492A-8F93-30B1D6861C81"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D4F5639-F628-4163-BFBA-25B4E7B2DFDE"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BC3FFF1-A25A-4C15-9162-1DA58350DAFE"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B54B2B0-B1E1-4B4E-A529-D0BD3B5DEEF3"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDB126BF-E09D-4E58-A39F-1190407D1CAB"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59649177-81EE-43C3-BFA5-E56E65B486DF"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "453B96ED-738A-4642-B461-C5216CF45CA3"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58D32489-627B-4E49-9329-8A3B8F8E4903"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@adobe.com"
}