← Back

CVE-2022-38421

nvd nist
Published: Oct 14, 2022Modified: Jun 17, 2026

JSON object

Loading...
7.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.2 / Impact: 5.9
Source: psirt@adobe.com (Secondary)

Description

Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but does require administrator privileges.

Affected (20)

Products: Adobe: Coldfusion
Adobe
1 product
Coldfusion
Configuration A
20 vulnerable
Vulnerable SoftwareAffected Versions
Adobe
Coldfusion
Version 2018
Coldfusion
Version 2018 update10
Coldfusion
Version 2018 update11
Coldfusion
Version 2018 update12
Coldfusion
Version 2018 update13
Coldfusion
Version 2018 update14
Coldfusion
Version 2018 update1
Coldfusion
Version 2018 update2
Coldfusion
Version 2018 update3
Coldfusion
Version 2018 update4
Coldfusion
Version 2018 update5
Coldfusion
Version 2018 update6
Coldfusion
Version 2018 update7
Coldfusion
Version 2018 update8
Coldfusion
Version 2018 update9
Coldfusion
Version 2021
Coldfusion
Version 2021 update1
Coldfusion
Version 2021 update2
Coldfusion
Version 2021 update3
Coldfusion
Version 2021 update4

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (2)

Source: psirt@adobe.com
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory

Timeline

No history available yet.