CVE-2022-38418: critical vulnerability in Adobe ColdFusion
Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Adobe ColdFusion has a path traversal flaw that allows attackers to access files and execute code on the server without needing any user interaction. This is a critical vulnerability affecting older versions of the software.
The vulnerability exploits improper pathname validation (CWE-22) in Adobe ColdFusion Update 14 and earlier, allowing unauthenticated remote attackers to traverse directory restrictions and achieve arbitrary code execution within the application context. No user interaction is required, making it a direct remote attack vector with complete system compromise potential.
In the same product, most dangerous first.