CVE-2020-9672
First published: Fri Jul 17 2020(Updated: )
Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe ColdFusion | =2016 | |
| Adobe ColdFusion | =2016-update1 | |
| Adobe ColdFusion | =2016-update10 | |
| Adobe ColdFusion | =2016-update11 | |
| Adobe ColdFusion | =2016-update12 | |
| Adobe ColdFusion | =2016-update13 | |
| Adobe ColdFusion | =2016-update14 | |
| Adobe ColdFusion | =2016-update15 | |
| Adobe ColdFusion | =2016-update2 | |
| Adobe ColdFusion | =2016-update3 | |
| Adobe ColdFusion | =2016-update4 | |
| Adobe ColdFusion | =2016-update5 | |
| Adobe ColdFusion | =2016-update6 | |
| Adobe ColdFusion | =2016-update7 | |
| Adobe ColdFusion | =2016-update8 | |
| Adobe ColdFusion | =2016-update9 | |
| Adobe ColdFusion | =2018 | |
| Adobe ColdFusion | =2018-update1 | |
| Adobe ColdFusion | =2018-update2 | |
| Adobe ColdFusion | =2018-update3 | |
| Adobe ColdFusion | =2018-update4 | |
| Adobe ColdFusion | =2018-update5 | |
| Adobe ColdFusion | =2018-update6 | |
| Adobe ColdFusion | =2018-update7 | |
| Adobe ColdFusion | =2018-update8 | |
| Adobe ColdFusion | =2018-update9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability identifier for this Adobe ColdFusion vulnerability?
The vulnerability identifier for this Adobe ColdFusion vulnerability is CVE-2020-9672.
What is the severity of CVE-2020-9672?
The severity of CVE-2020-9672 is high with a score of 7.8.
What is the affected software for this vulnerability?
The affected software for this vulnerability is Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions.
What is the description of this vulnerability?
This vulnerability in Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions allows for dll search-order hijacking, which could lead to privilege escalation.
How can this vulnerability be exploited?
This vulnerability can be exploited by exploiting the dll search-order hijacking vulnerability in Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions.
- collector/nvd-index
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/type
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/adobe
- canonical/adobe coldfusion
- version/adobe coldfusion/2016
- version/adobe coldfusion/2016-update1
- version/adobe coldfusion/2016-update10
- version/adobe coldfusion/2016-update11
- version/adobe coldfusion/2016-update12
- version/adobe coldfusion/2016-update13
- version/adobe coldfusion/2016-update14
- version/adobe coldfusion/2016-update15
- version/adobe coldfusion/2016-update2
- version/adobe coldfusion/2016-update3
- version/adobe coldfusion/2016-update4
- version/adobe coldfusion/2016-update5
- version/adobe coldfusion/2016-update6
- version/adobe coldfusion/2016-update7
- version/adobe coldfusion/2016-update8
- version/adobe coldfusion/2016-update9
- version/adobe coldfusion/2018
- version/adobe coldfusion/2018-update1
- version/adobe coldfusion/2018-update2
- version/adobe coldfusion/2018-update3
- version/adobe coldfusion/2018-update4
- version/adobe coldfusion/2018-update5
- version/adobe coldfusion/2018-update6
- version/adobe coldfusion/2018-update7
- version/adobe coldfusion/2018-update8
- version/adobe coldfusion/2018-update9