CVE-2020-3794: Critical severity Adobe ColdFusion vulnerability

Published Mar 25, 2020

Updated

ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability. Successful exploitation could lead to arbitrary code execution of files located in the webroot or its subdirectory.

Affected Software

22 affected components

Adobe ColdFusion=2016

Adobe ColdFusion=2016-update1

Adobe ColdFusion=2016-update10

Adobe ColdFusion=2016-update11

Adobe ColdFusion=2016-update12

Adobe ColdFusion=2016-update13

Adobe ColdFusion=2016-update2

Adobe ColdFusion=2016-update3

Adobe ColdFusion=2016-update4

Adobe ColdFusion=2016-update5

Adobe ColdFusion=2016-update6

Adobe ColdFusion=2016-update7

Adobe ColdFusion=2016-update8

Adobe ColdFusion=2016-update9

Adobe ColdFusion=2018

Adobe ColdFusion=2018-update1

Adobe ColdFusion=2018-update2

Adobe ColdFusion=2018-update3

Adobe ColdFusion=2018-update4

Adobe ColdFusion=2018-update5

Adobe ColdFusion=2018-update6

Adobe ColdFusion=2018-update7

Event History

Mar 25, 2020

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2020-3794?

The severity of CVE-2020-3794 is critical with a CVSS score of 9.8.

Which versions of ColdFusion are affected by CVE-2020-3794?

ColdFusion versions 2016 and ColdFusion 2018 are affected by CVE-2020-3794.

What is the impact of CVE-2020-3794?

Successful exploitation of CVE-2020-3794 could lead to arbitrary code execution of files located in the webroot or its subdirectory.

How can I fix CVE-2020-3794?

Apply the appropriate security update or patch provided by Adobe to mitigate the vulnerability in ColdFusion 2016 and ColdFusion 2018.

Where can I find more information about CVE-2020-3794?

You can find more information about CVE-2020-3794 on the Adobe website at https://helpx.adobe.com/security/products/coldfusion/apsb20-16.html.