cve-2017-11283
Vulnerability from cvelistv5
Published
2017-12-01 08:00
Modified
2024-08-05 18:05
Severity ?
EPSS score ?
24.76%
(0.95802)
Summary
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.
References
▼ | URL | Tags | |
---|---|---|---|
psirt@adobe.com | http://www.securityfocus.com/bid/100708 | Third Party Advisory, VDB Entry | |
psirt@adobe.com | http://www.securitytracker.com/id/1039321 | Third Party Advisory, VDB Entry | |
psirt@adobe.com | https://helpx.adobe.com/security/products/coldfusion/apsb17-30.html | Mitigation, Patch, Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/100708 | Third Party Advisory, VDB Entry | |
af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1039321 | Third Party Advisory, VDB Entry | |
af854a3a-2127-422b-91ae-364da2661108 | https://helpx.adobe.com/security/products/coldfusion/apsb17-30.html | Mitigation, Patch, Vendor Advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
n/a | Adobe ColdFusion Update 4 and earlier versions for ColdFusion 2016 release. Update 12 and earlier versions for ColdFusion 11. |
Version: Adobe ColdFusion Update 4 and earlier versions for ColdFusion 2016 release. Update 12 and earlier versions for ColdFusion 11. |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T18:05:30.182Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://helpx.adobe.com/security/products/coldfusion/apsb17-30.html", }, { name: "1039321", tags: [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred", ], url: "http://www.securitytracker.com/id/1039321", }, { name: "100708", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/100708", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Adobe ColdFusion Update 4 and earlier versions for ColdFusion 2016 release. Update 12 and earlier versions for ColdFusion 11.", vendor: "n/a", versions: [ { status: "affected", version: "Adobe ColdFusion Update 4 and earlier versions for ColdFusion 2016 release. Update 12 and earlier versions for ColdFusion 11.", }, ], }, ], datePublic: "2017-11-30T00:00:00", descriptions: [ { lang: "en", value: "Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.", }, ], problemTypes: [ { descriptions: [ { description: "Vulnerable 3rd Party Library", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2017-12-01T10:57:01", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://helpx.adobe.com/security/products/coldfusion/apsb17-30.html", }, { name: "1039321", tags: [ "vdb-entry", "x_refsource_SECTRACK", ], url: "http://www.securitytracker.com/id/1039321", }, { name: "100708", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/100708", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "psirt@adobe.com", ID: "CVE-2017-11283", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Adobe ColdFusion Update 4 and earlier versions for ColdFusion 2016 release. Update 12 and earlier versions for ColdFusion 11.", version: { version_data: [ { version_value: "Adobe ColdFusion Update 4 and earlier versions for ColdFusion 2016 release. Update 12 and earlier versions for ColdFusion 11.", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Vulnerable 3rd Party Library", }, ], }, ], }, references: { reference_data: [ { name: "https://helpx.adobe.com/security/products/coldfusion/apsb17-30.html", refsource: "CONFIRM", url: "https://helpx.adobe.com/security/products/coldfusion/apsb17-30.html", }, { name: "1039321", refsource: "SECTRACK", url: "http://www.securitytracker.com/id/1039321", }, { name: "100708", refsource: "BID", url: "http://www.securityfocus.com/bid/100708", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2017-11283", datePublished: "2017-12-01T08:00:00", dateReserved: "2017-07-13T00:00:00", dateUpdated: "2024-08-05T18:05:30.182Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { nvd: "{\"cve\":{\"id\":\"CVE-2017-11283\",\"sourceIdentifier\":\"psirt@adobe.com\",\"published\":\"2017-12-01T08:29:00.293\",\"lastModified\":\"2025-04-20T01:37:25.860\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.\"},{\"lang\":\"es\",\"value\":\"Adobe ColdFusion tiene una vulnerabilidad de deserialización de datos no fiables. Esto afecta al Update 4 y a versiones anteriores para ColdFusion 2016 y al Update 12 y versiones anteriores para ColdFusion 11.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":true,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:11.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"E217CE63-07DC-4A88-8877-181F33A21C20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:11.0:update1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7D4BD25E-6856-40EC-98A8-ACB540992487\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:11.0:update10:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F0907E8-7BC4-4F5A-894C-B7C5F6BAAEAE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:11.0:update11:*:*:*:*:*:*\",\"matchCriteriaId\":\"AFE18FEA-271A-42FE-8C24-19731DEB5444\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:11.0:update12:*:*:*:*:*:*\",\"matchCriteriaId\":\"15F7DCF1-D9F2-45C0-B089-E37C91579729\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:11.0:update2:*:*:*:*:*:*\",\"matchCriteriaId\":\"82F81CF8-1482-4731-AD34-677B8D6B930B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:11.0:update3:*:*:*:*:*:*\",\"matchCriteriaId\":\"57BBBE71-BBE0-4129-B997-3F9AF54BFBD8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:11.0:update4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8E514D95-9287-4A43-9A44-BD6F8EDC5DA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:11.0:update5:*:*:*:*:*:*\",\"matchCriteriaId\":\"96C50CD1-CE75-4D70-AD65-2DB6027D806A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:11.0:update6:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE1B1190-4699-4FB0-AD46-DF0233B5BA90\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:11.0:update7:*:*:*:*:*:*\",\"matchCriteriaId\":\"827CB550-5078-4FD5-8B1F-616C06912AD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:11.0:update8:*:*:*:*:*:*\",\"matchCriteriaId\":\"31F22450-F26C-4797-9292-66CA444C0D2C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:11.0:update9:*:*:*:*:*:*\",\"matchCriteriaId\":\"72450205-B4F4-4B44-9991-F4876D829BBD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2016:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"B262F442-FF7F-4CC0-A9C5-FFD0EDB08E38\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2016:update1:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F3D7C8E-6695-44DF-AC9A-1AE09C46C529\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2016:update2:*:*:*:*:*:*\",\"matchCriteriaId\":\"12BAE66C-A745-4661-B5BB-7FC2C169CC82\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2016:update3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E6EC92F3-1EF8-4820-9CD8-ECEA03D27A7B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2016:update4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7446D70-D616-4EC1-BC64-41CDE56EFEAE\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/100708\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1039321\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://helpx.adobe.com/security/products/coldfusion/apsb17-30.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Mitigation\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/100708\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1039321\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://helpx.adobe.com/security/products/coldfusion/apsb17-30.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Patch\",\"Vendor Advisory\"]}]}}", }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.