First published: Tue Oct 11 2022(Updated: )
Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. Exploitation of this issue does not require user interaction, but does require administrator privileges.
Credit: psirt@adobe.com
Affected Software | Affected Version | How to fix |
---|---|---|
Adobe ColdFusion | =2018 | |
Adobe ColdFusion | =2018-update1 | |
Adobe ColdFusion | =2018-update10 | |
Adobe ColdFusion | =2018-update11 | |
Adobe ColdFusion | =2018-update12 | |
Adobe ColdFusion | =2018-update13 | |
Adobe ColdFusion | =2018-update14 | |
Adobe ColdFusion | =2018-update2 | |
Adobe ColdFusion | =2018-update3 | |
Adobe ColdFusion | =2018-update4 | |
Adobe ColdFusion | =2018-update5 | |
Adobe ColdFusion | =2018-update6 | |
Adobe ColdFusion | =2018-update7 | |
Adobe ColdFusion | =2018-update8 | |
Adobe ColdFusion | =2018-update9 | |
Adobe ColdFusion | =2021 | |
Adobe ColdFusion | =2021-update1 | |
Adobe ColdFusion | =2021-update2 | |
Adobe ColdFusion | =2021-update3 | |
Adobe ColdFusion | =2021-update4 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID for this Adobe ColdFusion vulnerability is CVE-2022-38424.
The severity of CVE-2022-38424 is high with a CVSS score of 7.2.
The versions affected by CVE-2022-38424 are Adobe ColdFusion 2018 (Update 14 and earlier) and Adobe ColdFusion 2021 (Update 4 and earlier).
CVE-2022-38424 allows an attacker to perform arbitrary file system write, potentially leading to unauthorized access or data manipulation.
To fix CVE-2022-38424, you should update your Adobe ColdFusion installation to the latest available version.