CVE-2020-10145

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\. By default, unprivileged users can create files in this directory structure, which creates a privilege-escalation vulnerability.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284CWE-276

Affected software

No affected versions have been published.

Timeline

Published
May 27, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-101465.4The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited oCVE-2020-101489.8The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerabCVE-2020-10157.8An elevation of privilege vulnerability exists in the way that the User-Mode Power Service (UMPS) handles objects in memory, aka 'Windows ElCVE-2020-10165.5An information disclosure vulnerability exists when the Windows Push Notification Service improperly handles objects in memory, aka 'WindowsCVE-2020-10177.8An elevation of privilege vulnerability exists in the way the Windows Push Notification Service handles objects in memory, aka 'Windows PushCVE-2020-101738.8Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabilities via the ping and CVE-2020-101747.0init_tmp in TeeJee.FileSystem.vala in Timeshift before 20.03 unsafely reuses a preexisting temporary directory in the predictable location /CVE-2020-101769.8ASSA ABLOY Yale WIPC-301W 2.x.2.29 through 2.x.2.43_p1 devices allow Eval Injection of commands.CVE-2020-101775.5Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.CVE-2020-10187.5An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of aCVE-2020-101809.8The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 oCVE-2020-101819.8goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (admini
CVE-2020-10145: High severity, CVSS 7.8 | Vulnix