CVE-2022-38419CWE-611

Adobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system read

High · published October 14, 2022

Patch now

High probability of exploitation

CVSS calls it high at 7.5. It sits in the 99.0th percentile for exploit probability.

CVSS v3.1
7.5
EPSS
54%
Percentile
99.0
In the wild
Unconfirmed
What it is

Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.53712 · 99.0th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2022-10-14T19:42Z
EPSS history
Timeline
  • 14 OCT 19:42Z
    Adobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system read
    cvelistv5