PT-2022-6425 · Adobe · Coldfusion

Published 2022-10-11 · Updated 2022-10-20 · CVE-2022-38421

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier)

Description The issue is related to an improper limitation of a pathname to a restricted directory, also known as a path traversal vulnerability. This could result in arbitrary code execution in the context of the current user. Exploitation does not require user interaction but does require administrator privileges. The vulnerability can be exploited remotely, allowing an attacker to execute arbitrary code.

Recommendations For Adobe ColdFusion versions Update 14 and earlier, update to a version later than Update 14 to resolve the issue. For Adobe ColdFusion versions Update 4 and earlier, update to a version later than Update 4 to resolve the issue. As a temporary workaround, consider restricting access to sensitive directories to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-01229

CVE-2022-38421

ZDI-22-1433

Affected Products

Coldfusion

References · 5

• https://zerodayinitiative.com/advisories/ZDI-22-1433 · Security Note
• https://bdu.fstec.ru/vul/2023-01229 · Security Note
• https://helpx.adobe.com/security/products/coldfusion/apsb22-44.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38421 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38421 · Vendor Advisory