CVE-2018-15961
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload...
Basic Information
- CVE State
- PUBLISHED
- Reserved Date
- August 28, 2018
- Published Date
- September 25, 2018
- Last Updated
- February 04, 2025
- Vendor
- Adobe
- Product
- ColdFusion
- Description
- Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Scores
SSVC Information
- Exploitation
- active
- Automatable
- Yes
- Technical Impact
- total
References
Known Exploited Vulnerability Information
| Source | Added Date |
|---|---|
| CISA | 2021-11-03 00:00:00 UTC |
Scanner Integrations
| Scanner | URL | Date Detected |
|---|---|---|
| Metasploit | https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/coldfusion_ckeditor_file_upload.rb | 2025-04-29 11:01:21 UTC |
| Nuclei | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-15961.yaml | 2025-04-26 00:00:00 UTC |
Potential Proof of Concepts
Warning: These PoCs have not been tested and could contain malware. Use at your own risk.
coldfusion_ckeditor_file_upload
Type: metasploit • Created: Unknown
bu1xuan2/CVE-2018-15961
Type: github • Created: 2021-11-10 17:19:55 UTC • Stars: 0
orangmuda/CVE-2018-15961
Type: github • Created: 2021-10-03 23:31:47 UTC • Stars: 2
xbufu/CVE-2018-15961
Type: github • Created: 2021-06-30 08:15:18 UTC • Stars: 3
vah13/CVE-2018-15961
Type: github • Created: 2018-12-06 15:47:57 UTC • Stars: 9