CVE-2022-42341 HIGH

CVE-2022-42341: Adobe ColdFusion Improper Restriction of XML External Entity Reference Arbitrary file system read

Vendor Adobe
Product ColdFusion
Weakness CWE-611 · XXE
Published October 14, 2022
Last update April 23, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.

Key dates

02Disclosure timeline

October 14, 2022 CVE published
April 23, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-23195 Apache Ambari: XML External Entity (XXE) Vulnerability in Ambari/Oozie CVE-2023-51601 Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability CVE-2025-26400 SolarWinds Web Help Desk XML External Entity Injection (XXE) Vulnerability CVE-2022-41967 Improper Restriction of XML External Entity Reference in Dragonfly CVE-2021-1530 Cisco BroadWorks Messaging Server XML External Entity Injection Vulnerability