CVE-2022-38421: high-severity vulnerability in Adobe ColdFusion
Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Adobe ColdFusion contains a path traversal flaw that allows an administrator to execute arbitrary code on the server. An attacker with admin access can bypass directory restrictions and run malicious commands.
CWE-22 path traversal vulnerability in Adobe ColdFusion Update 14 or earlier (and Update 4 or earlier) allows authenticated administrators to escape directory restrictions and achieve remote code execution in the context of the application user. Exploitation requires valid admin credentials; no user interaction needed.
In the same product, most dangerous first.