CVE-2020-10145

The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\. By default, unprivileged users can create files in this directory structure, which creates a privilege-escalation vulnerability.

Score

CVSS 3.1 7.8 High

Status

Modified - cret@cert.org

Published

2021-05-27

Last modified

2024-08-04

Weaknesses

CWE-276, CWE-284

Affected products

• Coldfusion (Adobe)

References

• https://www.kb.cert.org/vuls/id/125331