CVE-2020-9673: 
Adobe ColdFusion 2016 vulnerability analysis and mitigation

CVE-2020-9673 is a DLL search-order hijacking vulnerability affecting Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions. The vulnerability was discovered and reported by Nuttakorn Tungpoonsup and Ammarit Thongthua of the Secure D Center Research Team, along with Sittikorn Sangrattanapitak. The CVE was created on March 2, 2020 (MITRE CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-426 (Untrusted Search Path). The attack requires local access and user interaction, but no privileges are needed to execute the attack (NVD).

Successful exploitation of this vulnerability could lead to privilege escalation, potentially allowing an attacker to execute arbitrary code with elevated privileges on the affected system (Adobe Security).

The vulnerability requires local access and user interaction to exploit. The attack complexity is considered low, and no privileges are required for exploitation (NVD).

Adobe has released security updates to address this vulnerability. Users of affected versions of ColdFusion 2016 and ColdFusion 2018 should update to the latest version as recommended by Adobe (Adobe Security).

The vulnerability was disclosed as part of Adobe's July 2020 security updates, which addressed multiple vulnerabilities across different Adobe products. Security researchers noted that while this vulnerability requires local access, it could be particularly dangerous when combined with other vulnerabilities (Threatpost).