10

CVE-2020-3794

ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability. Successful exploitation could lead to arbitrary code execution of files located in the webroot or its subdirectory.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Adobe ≫ Coldfusion Version 2016 Update -
Adobe ≫ Coldfusion Version 2016 Update update1
Adobe ≫ Coldfusion Version 2016 Update update10
Adobe ≫ Coldfusion Version 2016 Update update11
Adobe ≫ Coldfusion Version 2016 Update update12
Adobe ≫ Coldfusion Version 2016 Update update13
Adobe ≫ Coldfusion Version 2016 Update update2
Adobe ≫ Coldfusion Version 2016 Update update3
Adobe ≫ Coldfusion Version 2016 Update update4
Adobe ≫ Coldfusion Version 2016 Update update5
Adobe ≫ Coldfusion Version 2016 Update update6
Adobe ≫ Coldfusion Version 2016 Update update7
Adobe ≫ Coldfusion Version 2016 Update update8
Adobe ≫ Coldfusion Version 2016 Update update9
Adobe ≫ Coldfusion Version 2018 Update -
Adobe ≫ Coldfusion Version 2018 Update update1
Adobe ≫ Coldfusion Version 2018 Update update2
Adobe ≫ Coldfusion Version 2018 Update update3
Adobe ≫ Coldfusion Version 2018 Update update4
Adobe ≫ Coldfusion Version 2018 Update update5
Adobe ≫ Coldfusion Version 2018 Update update6
Adobe ≫ Coldfusion Version 2018 Update update7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 7.14% 0.937
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-829 Inclusion of Functionality from Untrusted Control Sphere

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

https://helpx.adobe.com/security/products/coldfusion/apsb20-16.html
Vendor Advisory