DLL Search-Order Hijacking in Adobe ColdFusion Products

CVE-2020-9673

Summary

Adobe ColdFusion versions 2016 and earlier, along with ColdFusion 2018 up to update 9, are susceptible to a DLL search-order hijacking vulnerability. This flaw allows an attacker to potentially exploit the environment, leading to privilege escalation. The vulnerability arises from improper handling of DLLs, which can be manipulated by attackers to execute malicious code. Organizations utilizing these versions of ColdFusion should assess their systems and consider applying updates or mitigations as outlined by Adobe.

References