Adobe ColdFusion CVE-2013-1389 Remote Code Execution Vulnerability

Bugtraq ID:	59849
Class:	Design Error
CVE:	CVE-2013-1389
Remote:	Yes
Local:	No
Published:	May 14 2013 12:00AM
Updated:	May 14 2013 12:00AM
Credit:	Tenable Network Security through the CERT Coordination Center
Vulnerable:	Adobe ColdFusion 9.0.2 Adobe ColdFusion 9.0.1 Adobe ColdFusion 9.0 Adobe ColdFusion 10
Not Vulnerable:	Adobe ColdFusion 9.0.2 Update 5 Adobe ColdFusion 9.0.1 Update 10 Adobe ColdFusion 9.0 Update 11 Adobe ColdFusion 10 Update 10

Adobe ColdFusion CVE-2013-1389 Remote Code Execution Vulnerability

Adobe ColdFusion is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

ColdFusion 10, 9.0.2, 9.0.1, and 9.0 are vulnerable.

Adobe ColdFusion CVE-2013-1389 Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Adobe ColdFusion CVE-2013-1389 Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Adobe ColdFusion CVE-2013-1389 Remote Code Execution Vulnerability

References:

• Adobe ColdFusion Home Page (Adobe)
  
• Adobe Homepage (Adobe)