CVE-2020-9672: 
Adobe ColdFusion 2016 vulnerability analysis and mitigation

CVE-2020-9672 is a DLL search-order hijacking vulnerability affecting Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions. The vulnerability was disclosed in July 2020 and affects Adobe's platform for building and deploying web and mobile applications (NVD).

The vulnerability is classified as a DLL search-order hijacking issue with a CVSS v3.1 base score of 7.8 (HIGH), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is categorized under CWE-426 (Untrusted Search Path) (NVD).

Successful exploitation of this vulnerability could lead to privilege escalation, potentially allowing an attacker to execute code with elevated privileges on the affected system (NVD).

The vulnerability requires local access and user interaction for successful exploitation. While the vulnerability is rated as high severity, Adobe has ranked it with a priority rating of 2, indicating systems could be at increased risk based on past history, though there were no known exploits at the time of disclosure (Threatpost).

Adobe has released security updates to address this vulnerability. Users should update to versions newer than ColdFusion 2016 update 15 or ColdFusion 2018 update 9 (Adobe Advisory).