PT-2019-3372 · Adobe · Coldfusion

Publicado 2019-09-24 · Atualizado 2020-09-04 · CVE-2019-8074

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2018 update 4 and earlier ColdFusion versions 2016 update 11 and earlier

Description The issue is related to path traversal errors in the ColdFusion platform, allowing a remote attacker to write arbitrary files to the device's file system. Successful exploitation could lead to access control bypass in the context of the current user.

Recommendations For ColdFusion versions 2018 update 4 and earlier, update to a version later than update 4 to resolve the issue. For ColdFusion versions 2016 update 11 and earlier, update to a version later than update 11 to resolve the issue. As a temporary workaround, consider restricting access to sensitive directories and files to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2019-03502

CVE-2019-8074

Produtos afetados

Coldfusion

Referências · 5

• https://osv.dev/vulnerability/CVE-2019-8074 · Aviso do Fabricante
• https://cybersecurity-help.cz/vdb/SB2019092423 · Nota
• https://helpx.adobe.com/security/products/coldfusion/apsb19-47.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-8074 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-03502 · Nota de Segurança