PT-2020-1933 · Adobe · Coldfusion

Published 2020-02-20 · Updated 2021-07-21 · CVE-2020-3794

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2016, and 2018

Description The issue is related to a file inclusion vulnerability. It could allow for arbitrary code execution of files located in the webroot or its subdirectory. The vulnerability is also associated with PHP function names for include or require, which could enable a remote attacker to execute arbitrary PHP code in the target system by sending a specially crafted HTTP request.

Recommendations For ColdFusion 2016, update to a version that includes the fix for this issue. For ColdFusion 2018, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to PHP functions include or require to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-829

CWE-98

Related Identifiers

BDU:2020-01211

CVE-2020-3794

Affected Products

Coldfusion

References · 7

• https://bdu.fstec.ru/vul/2020-01211 · Security Note
• https://helpx.adobe.com/security/products/coldfusion/apsb20-16.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3794 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3794 · Security Note
• https://securitylab.ru/news/506056.php · Note
• https://cybersecurity-help.cz/blog/999.html · Note
• https://cybersecurity-help.cz/vdb/SB2020031814 · Note