CVE-2022-38419

HIGH

Adobe ColdFusion Update 14 and earlier - XML External Entity Injection

Title source: llm
STIX 2.1

Description

Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.

References (1)

Core 1

Scores

CVSS v3 7.5
EPSS 0.5303
EPSS Percentile 98.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-611
Status published
Products (2)
adobe/coldfusion 2018 (15 CPE variants)
adobe/coldfusion 2021 (5 CPE variants)
Published Oct 14, 2022
Tracked Since Feb 18, 2026