« Volver al listado

CVE-2020-3794

Estado: ModificadaCrítica (9.8)—

ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability. Successful exploitation could lead to arbitrary code execution of files located in the webroot or its subdirectory.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Adobe — Coldfusion

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-3794",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@adobe.com",
      "affectedData": [
        {
          "vendor": "Adobe",
          "product": "ColdFusion",
          "versions": [
            {
              "status": "affected",
              "version": "ColdFusion 2016, and ColdFusion 2018 versions"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-03-25T20:15:14.867",
  "references": [
    {
      "url": "https://helpx.adobe.com/security/products/coldfusion/apsb20-16.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@adobe.com"
    },
    {
      "url": "https://helpx.adobe.com/security/products/coldfusion/apsb20-16.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-829"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability. Successful exploitation could lead to arbitrary code execution of files located in the webroot or its subdirectory."
    },
    {
      "lang": "es",
      "value": "ColdFusion versiones ColdFusion 2016 y ColdFusion 2018, presentan una vulnerabilidad de inclusión de archivos. Una explotación con éxito podría conllevar a una ejecución de código arbitraria de archivos ubicados en la webroot o su subdirectorio."
    }
  ],
  "lastModified": "2026-06-17T03:19:03.770",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B262F442-FF7F-4CC0-A9C5-FFD0EDB08E38"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F3D7C8E-6695-44DF-AC9A-1AE09C46C529"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "449A07A6-1D7A-49CF-9316-5EAAFAF38956"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5265059-D9DD-44E6-B68C-81838BCA64C5"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2277A67-562B-4185-AE5F-EB93563F16DF"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C6E6735-A72F-4CC7-8239-CC96DEF4E5CA"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12BAE66C-A745-4661-B5BB-7FC2C169CC82"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6EC92F3-1EF8-4820-9CD8-ECEA03D27A7B"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7446D70-D616-4EC1-BC64-41CDE56EFEAE"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59453B01-EAAF-4291-B2C2-98835F5AFE80"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63076ED8-FC30-40B1-99A7-D0069423A536"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4B4228E-6FBD-492A-8F93-30B1D6861C81"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D4F5639-F628-4163-BFBA-25B4E7B2DFDE"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2016:update9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BC3FFF1-A25A-4C15-9162-1DA58350DAFE"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B54B2B0-B1E1-4B4E-A529-D0BD3B5DEEF3"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDB126BF-E09D-4E58-A39F-1190407D1CAB"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59649177-81EE-43C3-BFA5-E56E65B486DF"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "453B96ED-738A-4642-B461-C5216CF45CA3"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58D32489-627B-4E49-9329-8A3B8F8E4903"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D5860E1-D293-48FE-9796-058B78B2D571"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F9336CC-E38F-4BCB-83CD-805EC7FEF806"
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97964507-047A-4CC8-8D2B-0EA0C7F9BD50"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@adobe.com"
}