Evil-DB LogoEvil-DB
← All CVEs

CVE-2017-3066

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Added 2025-02-24Remediation due 2025-03-17

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.

9.8
CVSS
90.6%
EPSS (exploit prob.)
100th
EPSS percentile
2017-04-27
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-502

Affected products

VendorProductAffected versions
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion10.0
adobecoldfusion11.0
adobecoldfusion11.0
adobecoldfusion11.0
adobecoldfusion11.0
adobecoldfusion11.0
adobecoldfusion11.0
adobecoldfusion11.0
adobecoldfusion11.0
adobecoldfusion11.0
adobecoldfusion11.0
adobecoldfusion11.0
adobecoldfusion11.0
adobecoldfusion2016
adobecoldfusion2016
adobecoldfusion2016
adobecoldfusion2016

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-3066