CVE-2023-26361: 
Adobe ColdFusion 2018 vulnerability analysis and mitigation

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory vulnerability (CVE-2023-26361). The vulnerability was discovered by Dusan Stevanovic of Trend Micro and publicly disclosed on April 12, 2023. This security flaw is classified as a path traversal vulnerability that could potentially lead to arbitrary file system read operations (NVD, Adobe Advisory).

The vulnerability exists within the copydirectory endpoint and stems from inadequate validation of user-supplied paths before their use in file operations. The issue has been assigned a CVSS v3.1 Base Score of 4.9 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. This indicates that while the vulnerability is network-accessible and requires no user interaction, it does necessitate high-level privileges for exploitation (ZDI Advisory).

If successfully exploited, this vulnerability could allow attackers to perform arbitrary file system read operations in the context of SYSTEM privileges. The impact is primarily focused on information disclosure, with no direct impact on system integrity or availability (ZDI Advisory).

The vulnerability requires authentication with administrator privileges for successful exploitation. While the attack complexity is considered low, the requirement for high-level privileges significantly reduces the practical exploitability of this vulnerability (NVD).

Adobe has released security updates to address this vulnerability. Users are advised to update their ColdFusion installations to versions newer than 2018 Update 15 or 2021 Update 5, depending on their installation version (Adobe Advisory).