CVE-2020-9673 is a DLL search-order hijacking vulnerability affecting Adobe ColdFusion 2016 (update 15 and earlier) and ColdFusion 2018 (update 9 and earlier). This vulnerability has a CVSS score of 7.8 (High) and could lead to privilege escalation if successfully exploited. The attack requires user interaction (UI:R) and local access (AV:L), but has low attack complexity (AC:L). While there is no evidence of active exploitation (KEV: No) or publicly available exploit code (Metasploit, Nuclei, ExploitDB: None), it has received some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2016CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:2016:-:*:*:*:*:*:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:2016:update1:*:*:*:*:*:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:2016:update10:*:*:*:*:*:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:2016:update11:*:*:*:*:*:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:2016:update12:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.