CVE-2022-35711: critical vulnerability in Adobe ColdFusion
Adobe ColdFusion ODBC Server Heap-based Buffer Overflow Remote Code Execution Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Adobe ColdFusion contains a memory flaw that allows attackers to send specially crafted network packets to crash the server or execute arbitrary code without needing user interaction. This is a critical vulnerability because it can be exploited remotely and automatically.
A heap-based buffer overflow in Adobe ColdFusion's ODBC server component allows remote code execution when malicious network packets are sent to the affected system. The attack vector is network-based with no authentication or user interaction required; exploitation occurs upon receipt of a crafted packet, resulting in code execution with the privileges of the ColdFusion process.
In the same product, most dangerous first.