PT-2020-5384 · Adobe · Coldfusion

Published 2020-07-14 · Updated 2020-09-04 · CVE-2020-9672

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions prior to 2016 update 15 Adobe ColdFusion 2018 versions prior to update 9

Description The issue is related to incorrect handling of the path to DLL libraries, which could allow an attacker to escalate their privileges. Successful exploitation of this issue may lead to privilege escalation.

Recommendations For Adobe ColdFusion 2016, update to a version later than update 15. For Adobe ColdFusion 2018, update to a version later than update 9.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

BDU:2021-00400

CVE-2020-9672

Affected Products

Coldfusion

References · 4

• https://helpx.adobe.com/security/products/coldfusion/apsb20-43.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00400 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9672 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9672 · Security Note