CVE-2020-10145

HIGH

Adobe ColdFusion - Improper Access Control in Default Installation Directory

Title source: llm

Description

The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\. By default, unprivileged users can create files in this directory structure, which creates a privilege-escalation vulnerability.

References (1)

Core 1

Core References

Third Party Advisory, US Government Resource x_refsource_misc

https://www.kb.cert.org/vuls/id/125331

Scores

CVSS v3 7.8

EPSS 0.0050

EPSS Percentile 38.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-276 CWE-284

Status published

Products (3)

adobe/coldfusion 2016

adobe/coldfusion 2018

adobe/coldfusion 2021

Published May 27, 2021

Tracked Since Feb 18, 2026