VulnerabilityModified

CVE-2019-8074

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Path Traversal vulnerability.

CRITICAL 9.8EPSS 18.9%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 18.9%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.

Description

ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Path Traversal vulnerability. Successful exploitation could lead to Access Control Bypass in the context of the current user.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 18.86% probability · 97th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: adobe/coldfusion
Source: psirt@adobe.com

References

https://helpx.adobe.com/security/products/coldfusion/apsb19-47.htmlVendor Advisory
https://helpx.adobe.com/security/products/coldfusion/apsb19-47.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.