PT-2021-7669 · Adobe · Coldfusion

Published 2021-10-11 · Updated 2022-10-18 · CVE-2022-38424

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions Update 14 and earlier Adobe ColdFusion versions Update 4 and earlier

Description The issue exists due to improper limitation of a pathname to a restricted directory, allowing for path traversal. This could result in arbitrary file system write, potentially impacting the confidentiality, integrity, and availability of protected information. Exploitation does not require user interaction but does require administrator privileges.

Recommendations For Adobe ColdFusion versions Update 14 and earlier, update to a version later than Update 14 to resolve the issue. For Adobe ColdFusion versions Update 4 and earlier, update to a version later than Update 4 to resolve the issue. As a temporary workaround, consider restricting access to sensitive directories and files to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-01164

CVE-2022-38424

ZDI-22-1432

Affected Products

Coldfusion

References · 5

• https://helpx.adobe.com/security/products/coldfusion/apsb22-44.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01164 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-38424 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1432 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38424 · Vendor Advisory