PT-2020-1933
CVE-2020-3794
·
تاريخ النشر
2020-02-20
·
تاريخ التحديث
2021-07-21
الوصف من
CVSS 2.0
10
حرجةالمقاييسAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions
ColdFusion versions 2016, and 2018
Description
The issue is related to a file inclusion vulnerability. It could allow for arbitrary code execution of files located in the webroot or its subdirectory. The vulnerability is also associated with PHP function names for include or require, which could enable a remote attacker to execute arbitrary PHP code in the target system by sending a specially crafted HTTP request.
Recommendations
For ColdFusion 2016, update to a version that includes the fix for this issue.
For ColdFusion 2018, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to PHP functions include or require to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾