PT-2023-2244 · Adobe · Coldfusion

Published 2023-03-14 · Updated 2024-08-20 · CVE-2023-26361

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 2018 Update 15 and earlier Adobe ColdFusion versions 2021 Update 5 and earlier

Description The issue exists due to improper limitation of a pathname to a restricted directory, allowing an attacker to read arbitrary files using a specially crafted HTTP request. This can result in arbitrary file system read. Exploitation does not require user interaction but does require administrator privileges.

Recommendations For Adobe ColdFusion versions 2018 Update 15 and earlier, update to a version later than Update 15. For Adobe ColdFusion versions 2021 Update 5 and earlier, update to a version later than Update 5. As a temporary workaround, consider restricting access to sensitive directories to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-01999

CVE-2023-26361

ZDI-23-1102

Affected Products

Coldfusion

References · 8

• https://osv.dev/vulnerability/CVE-2023-26361 · Vendor Advisory
• https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01999 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-26361 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-1102 · Security Note
• https://t.me/cvenotify/46986 · Telegram Post
• https://twitter.com/vicariusltd/status/1825918687850684839 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2023031457 · Note