PT-2020-6354 · Adobe · Coldfusion

Published 2020-04-14 · Updated 2020-09-04 · CVE-2020-3768

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 2016 through 2018

Description The issue is related to incorrect handling of the path to DLL libraries, which can be exploited to potentially allow an attacker to escalate their privileges.

Recommendations For ColdFusion 2016, update to a version that fixes the dll search-order hijacking issue. For ColdFusion 2018, apply the necessary security patch to resolve the privilege escalation vulnerability.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

BDU:2021-04305

CVE-2020-3768

Affected Products

Coldfusion

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-3768 · Security Note
• https://helpx.adobe.com/security/products/coldfusion/apsb20-18.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3768 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04305 · Security Note