CVE-2022-38421: Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability
First published: Fri Oct 14 2022(Updated: )
Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but does require administrator privileges.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe ColdFusion | =2018 | |
| Adobe ColdFusion | =2018-update1 | |
| Adobe ColdFusion | =2018-update10 | |
| Adobe ColdFusion | =2018-update11 | |
| Adobe ColdFusion | =2018-update12 | |
| Adobe ColdFusion | =2018-update13 | |
| Adobe ColdFusion | =2018-update14 | |
| Adobe ColdFusion | =2018-update2 | |
| Adobe ColdFusion | =2018-update3 | |
| Adobe ColdFusion | =2018-update4 | |
| Adobe ColdFusion | =2018-update5 | |
| Adobe ColdFusion | =2018-update6 | |
| Adobe ColdFusion | =2018-update7 | |
| Adobe ColdFusion | =2018-update8 | |
| Adobe ColdFusion | =2018-update9 | |
| Adobe ColdFusion | =2021 | |
| Adobe ColdFusion | =2021-update1 | |
| Adobe ColdFusion | =2021-update2 | |
| Adobe ColdFusion | =2021-update3 | |
| Adobe ColdFusion | =2021-update4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2022-38421?
CVE-2022-38421 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Adobe ColdFusion that could result in arbitrary code execution.
How does CVE-2022-38421 affect Adobe ColdFusion?
CVE-2022-38421 affects Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier).
What is the severity of CVE-2022-38421?
CVE-2022-38421 has a severity rating of 7.2 (High).
How can CVE-2022-38421 be fixed?
To fix CVE-2022-38421, Adobe recommends updating to the latest version of ColdFusion.
Where can I find more information about CVE-2022-38421?
More information about CVE-2022-38421 can be found on the Adobe Security Bulletin APSB22-44.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/last-modified-date
- agent/remedy
- agent/author
- agent/severity
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/adobe
- canonical/adobe coldfusion
- version/adobe coldfusion/2018
- version/adobe coldfusion/2018-update1
- version/adobe coldfusion/2018-update10
- version/adobe coldfusion/2018-update11
- version/adobe coldfusion/2018-update12
- version/adobe coldfusion/2018-update13
- version/adobe coldfusion/2018-update14
- version/adobe coldfusion/2018-update2
- version/adobe coldfusion/2018-update3
- version/adobe coldfusion/2018-update4
- version/adobe coldfusion/2018-update5
- version/adobe coldfusion/2018-update6
- version/adobe coldfusion/2018-update7
- version/adobe coldfusion/2018-update8
- version/adobe coldfusion/2018-update9
- version/adobe coldfusion/2021
- version/adobe coldfusion/2021-update1
- version/adobe coldfusion/2021-update2
- version/adobe coldfusion/2021-update3
- version/adobe coldfusion/2021-update4