First published: Tue Oct 11 2022(Updated: )
Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but does require administrator privileges.
Credit: psirt@adobe.com
Affected Software | Affected Version | How to fix |
---|---|---|
Adobe ColdFusion | =2018 | |
Adobe ColdFusion | =2018-update1 | |
Adobe ColdFusion | =2018-update10 | |
Adobe ColdFusion | =2018-update11 | |
Adobe ColdFusion | =2018-update12 | |
Adobe ColdFusion | =2018-update13 | |
Adobe ColdFusion | =2018-update14 | |
Adobe ColdFusion | =2018-update2 | |
Adobe ColdFusion | =2018-update3 | |
Adobe ColdFusion | =2018-update4 | |
Adobe ColdFusion | =2018-update5 | |
Adobe ColdFusion | =2018-update6 | |
Adobe ColdFusion | =2018-update7 | |
Adobe ColdFusion | =2018-update8 | |
Adobe ColdFusion | =2018-update9 | |
Adobe ColdFusion | =2021 | |
Adobe ColdFusion | =2021-update1 | |
Adobe ColdFusion | =2021-update2 | |
Adobe ColdFusion | =2021-update3 | |
Adobe ColdFusion | =2021-update4 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2022-38421 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Adobe ColdFusion that could result in arbitrary code execution.
CVE-2022-38421 affects Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier).
CVE-2022-38421 has a severity rating of 7.2 (High).
To fix CVE-2022-38421, Adobe recommends updating to the latest version of ColdFusion.
More information about CVE-2022-38421 can be found on the Adobe Security Bulletin APSB22-44.