by Kastro
Paper/Archive/CVE-2022-38418

CVE-2022-38418

Adobe ColdFusion — Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability

EPSS 80%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.6.996 × 2019.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Affected

ProductAffectedFixed inSource
ColdFusionunspecified – CF2021U4–CNA
ColdFusionunspecified – CF2018u14–CNA
ColdFusionunspecified – None–CNA

Scores by source

adobe (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refhelpx.adobe.com/security/products/coldfusion/apsb22-44.html