PT-2022-6420 · Adobe · Coldfusion

Published 2022-10-11 · Updated 2022-10-20 · CVE-2022-38418

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions Update 14 and earlier Adobe ColdFusion versions Update 4 and earlier

Description The issue exists due to improper limitation of a pathname to a restricted directory, allowing a remote attacker to execute arbitrary code in the context of the current user. Exploitation of this issue does not require user interaction.

Recommendations For Adobe ColdFusion versions Update 14 and earlier, update to a version later than Update 14 to resolve the issue. For Adobe ColdFusion versions Update 4 and earlier, update to a version later than Update 4 to resolve the issue. As a temporary workaround, consider restricting access to sensitive directories to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-01221

CVE-2022-38418

ZDI-22-1434

Affected Products

Coldfusion

References · 6

• https://osv.dev/vulnerability/CVE-2022-38418 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1434 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-38418 · Security Note
• https://bdu.fstec.ru/vul/2023-01221 · Security Note
• https://helpx.adobe.com/security/products/coldfusion/apsb22-44.html · Vendor Advisory
• https://t.me/cibsecurity/51510 · Telegram Post