CVE Vulnerabilities

CVE-2024-41874

Deserialization of Untrusted Data

Published: Sep 13, 2024 | Modified: Sep 13, 2024
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability by providing crafted input to the application, which when deserialized, leads to execution of malicious code. Exploitation of this issue does not require user interaction.

Weakness

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Software

Name Vendor Start Version End Version
Coldfusion Adobe 2023 (including) 2023 (including)
Coldfusion Adobe 2023-update1 (including) 2023-update1 (including)
Coldfusion Adobe 2023-update2 (including) 2023-update2 (including)
Coldfusion Adobe 2023-update3 (including) 2023-update3 (including)
Coldfusion Adobe 2023-update4 (including) 2023-update4 (including)
Coldfusion Adobe 2023-update5 (including) 2023-update5 (including)
Coldfusion Adobe 2023-update6 (including) 2023-update6 (including)
Coldfusion Adobe 2023-update7 (including) 2023-update7 (including)
Coldfusion Adobe 2023-update8 (including) 2023-update8 (including)
Coldfusion Adobe 2023-update9 (including) 2023-update9 (including)

Potential Mitigations

  • Make fields transient to protect them from deserialization.
  • An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.

References