PT-2019-3372 · Adobe · Coldfusion

Published 2019-09-24 · Updated 2020-09-04 · CVE-2019-8074

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2018 update 4 and earlier ColdFusion versions 2016 update 11 and earlier

Description The issue is related to path traversal errors in the ColdFusion platform, allowing a remote attacker to write arbitrary files to the device's file system. Successful exploitation could lead to access control bypass in the context of the current user.

Recommendations For ColdFusion versions 2018 update 4 and earlier, update to a version later than update 4 to resolve the issue. For ColdFusion versions 2016 update 11 and earlier, update to a version later than update 11 to resolve the issue. As a temporary workaround, consider restricting access to sensitive directories and files to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2019-03502

CVE-2019-8074

Affected Products

Coldfusion

References · 5

• https://osv.dev/vulnerability/CVE-2019-8074 · Vendor Advisory
• https://helpx.adobe.com/security/products/coldfusion/apsb19-47.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8074 · Security Note
• https://bdu.fstec.ru/vul/2019-03502 · Security Note
• https://cybersecurity-help.cz/vdb/SB2019092423 · Note