{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-35690", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "assignerShortName": "adobe", "datePublished": "2022-10-14T19:42:55.991274Z", "dateUpdated": "2024-09-16T20:07:29.658Z", "dateReserved": "2022-07-12T00:00:00"}, "containers": {"cna": {"title": "Adobe ColdFusion ODBC Agent Stack-based Buffer Overflow Remote Code Execution Vulnerability", "datePublic": "2022-10-11T00:00:00", "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2022-10-14T00:00:00"}, "descriptions": [{"lang": "en", "value": "Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server."}], "affected": [{"vendor": "Adobe", "product": "ColdFusion", "versions": [{"version": "unspecified", "lessThanOrEqual": "CF2021U4", "status": "affected", "versionType": "custom"}, {"version": "unspecified", "lessThanOrEqual": "CF2018u14", "status": "affected", "versionType": "custom"}, {"version": "unspecified", "lessThanOrEqual": "None", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://helpx.adobe.com/security/products/coldfusion/apsb22-44.html"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "Stack-based Buffer Overflow (CWE-121)", "cweId": "CWE-121"}]}], "source": {"discovery": "EXTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:36:44.458Z"}, "title": "CVE Program Container", "references": [{"url": "https://helpx.adobe.com/security/products/coldfusion/apsb22-44.html", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*", "matchCriteriaId": "3B54B2B0-B1E1-4B4E-A529-D0BD3B5DEEF3", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*", "matchCriteriaId": "EDB126BF-E09D-4E58-A39F-1190407D1CAB", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*", "matchCriteriaId": "8DDD85DF-69A0-476F-8365-CD67C75CF0CE", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:*", "matchCriteriaId": "23F63675-7817-4AF0-A7DB-5E35EDABF04E", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:*", "matchCriteriaId": "3E3BF53E-2C0D-4F79-8B62-4C2A50CB5F52", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:*", "matchCriteriaId": "C26BF72C-E991-4170-B68B-09B20B6C0679", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:*", "matchCriteriaId": "25B4B4F2-318F-4046-ADE5-E9DD64F83FD9", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*", "matchCriteriaId": "59649177-81EE-43C3-BFA5-E56E65B486DF", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*", "matchCriteriaId": "453B96ED-738A-4642-B461-C5216CF45CA3", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*", "matchCriteriaId": "58D32489-627B-4E49-9329-8A3B8F8E4903", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*", "matchCriteriaId": "6D5860E1-D293-48FE-9796-058B78B2D571", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*", "matchCriteriaId": "9F9336CC-E38F-4BCB-83CD-805EC7FEF806", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*", "matchCriteriaId": "97964507-047A-4CC8-8D2B-0EA0C7F9BD50", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*", "matchCriteriaId": "82208628-F32A-4380-9B0F-DC8507E7701D", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*", "matchCriteriaId": "1563CE5E-A4F7-40A4-A050-BB96E332D8DD", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*", "matchCriteriaId": "7A94B406-C011-4673-8C2B-0DD94D46CC4C", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*", "matchCriteriaId": "AFD05E3A-10F9-4C75-9710-BA46B66FF6E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*", "matchCriteriaId": "D57C8681-AC68-47DF-A61E-B5C4B4A47663", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*", "matchCriteriaId": "75608383-B727-48D6-8FFA-D552A338A562", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*", "matchCriteriaId": "7773DB68-414A-4BA9-960F-52471A784379", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server."}, {"lang": "es", "value": "Adobe ColdFusion versiones Update 14 (y anteriores) y Update 4 (y anteriores) est\u00e1n afectadas por una vulnerabilidad de desbordamiento del b\u00fafer en la regi\u00f3n Stack de la memoria que podr\u00eda resultar en una ejecuci\u00f3n de c\u00f3digo arbitrario en el contexto del usuario actual. No es requerida una interacci\u00f3n del usuario para la explotaci\u00f3n de este problema, la vulnerabilidad es desencadenada cuando es enviado un paquete de red dise\u00f1ado al servidor"}], "id": "CVE-2022-35690", "lastModified": "2022-10-19T06:16:16.667", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "psirt@adobe.com", "type": "Secondary"}]}, "published": "2022-10-14T20:15:11.310", "references": [{"source": "psirt@adobe.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/coldfusion/apsb22-44.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-121"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{}