PT-2019-5913 · Adobe · Coldfusion

Published 2019-12-10 · Updated 2021-07-21 · CVE-2019-8256

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions Update 6 and earlier

Description The issue is related to errors in using standard permissions, specifically an insecure inherited permissions vulnerability of the default installation directory. This could allow an attacker to escalate their privileges.

Recommendations For Adobe ColdFusion versions Update 6 and earlier, update to a version later than Update 6 to resolve the issue. As a temporary workaround, consider restricting access to the default installation directory to minimize the risk of exploitation.

Fix

Incorrect Permission

Incorrect Default Permissions

Weakness Enumeration

CWE-732

CWE-276

Related Identifiers

BDU:2021-03787

CVE-2019-8256

Affected Products

Coldfusion

References · 4

• https://helpx.adobe.com/security/products/coldfusion/apsb19-58.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03787 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-8256 · Security Note
• https://osv.dev/vulnerability/CVE-2019-8256 · Vendor Advisory