PT-2021-7670 · Adobe · Coldfusion

Published 2021-10-11 · Updated 2022-10-20 · CVE-2022-35711

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions Update 14 and earlier Adobe ColdFusion versions Update 4 and earlier

Description The issue is related to a Heap-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, and it is triggered when a crafted network packet is sent to the server.

Recommendations For Adobe ColdFusion versions Update 14 and earlier, update to a version later than Update 14 to resolve the issue. For Adobe ColdFusion versions Update 4 and earlier, update to a version later than Update 4 to resolve the issue. As a temporary workaround, consider restricting access to the server to minimize the risk of exploitation.

Fix

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-122

CWE-787

Related Identifiers

BDU:2023-01165

CVE-2022-35711

ZDI-22-1415

Affected Products

Coldfusion

References · 6

• https://helpx.adobe.com/security/products/coldfusion/apsb22-44.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01165 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35711 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1415 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-35711 · Security Note
• https://t.me/cibsecurity/51508 · Telegram Post