cbcvebase.
CVE-2019-7816
published 2019-05-24

CVE-2019-7816: ColdFusion versions Update 2 and earlier, Update 9 and earlier, and Update 17 and earlier have a file upload restriction bypass vulnerability. Successful…

PriorityP182critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
68.37%
99.2th percentile
ColdFusion versions Update 2 and earlier, Update 9 and earlier, and Update 17 and earlier have a file upload restriction bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

Affected

4 ranges
VendorProductVersion rangeFixed in
adobecoldfusion
adobecoldfusion
adobecoldfusion
adobecoldfusion

Detection & IOCsextracted from sources · hover to see the quote

  • Attacker must upload a malicious file to a publicly accessible directory and then execute it remotely — monitor for unexpected file uploads (e.g., CFM/JSP webshells) in web-accessible ColdFusion upload directories followed by HTTP GET/POST requests to those same paths.
  • This vulnerability has been confirmed exploited in the wild — treat any ColdFusion instance on Update 2/9/17 or earlier as actively targeted and prioritize detection of inbound file-upload requests.
  • ·Blocking HTTP requests to directories containing uploaded files is a recommended mitigation — verify ColdFusion server configuration enforces this restriction to reduce attack surface.

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.