CVE-2022-38419: Adobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system read
Published Oct 14, 2022
·Updated
Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.
Affected Software
20 affected components
Adobe ColdFusion=2018
Adobe ColdFusion=2018-update1
Adobe ColdFusion=2018-update10
Adobe ColdFusion=2018-update11
Adobe ColdFusion=2018-update12
Adobe ColdFusion=2018-update13
Adobe ColdFusion=2018-update14
Adobe ColdFusion=2018-update2
Adobe ColdFusion=2018-update3
Adobe ColdFusion=2018-update4
Adobe ColdFusion=2018-update5
Adobe ColdFusion=2018-update6
Adobe ColdFusion=2018-update7
Adobe ColdFusion=2018-update8
Adobe ColdFusion=2018-update9
Adobe ColdFusion=2021
Adobe ColdFusion=2021-update1
Adobe ColdFusion=2021-update2
Adobe ColdFusion=2021-update3
Adobe ColdFusion=2021-update4
Remediation
Event History
Oct 14, 2022
CVE Published
via MITRE·07:42 PM
Data Sourced
via MITRE·07:42 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2022-38419.
2
What is the severity level of CVE-2022-38419?
The severity level of CVE-2022-38419 is high.
3
Which software versions are affected by CVE-2022-38419?
Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by CVE-2022-38419.
4
What is the impact of CVE-2022-38419?
CVE-2022-38419 can result in arbitrary file system read.
5
How can CVE-2022-38419 be fixed?
To fix CVE-2022-38419, it is recommended to update to the latest version of Adobe ColdFusion.