CVE-2022-42341CWE-611

Adobe ColdFusion Improper Restriction of XML External Entity Reference Arbitrary file system read

High · published October 14, 2022

CVSS v3.1
7.5
EPSS
36%
Percentile
98.5
In the wild
Unconfirmed
What it is

Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.36128 · 98.5th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2022-10-14T19:42Z
EPSS history
Timeline
  • 14 OCT 19:42Z
    Adobe ColdFusion Improper Restriction of XML External Entity Reference Arbitrary file system read
    cvelistv5