ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.
References
| Link | Resource |
|---|---|
| https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html | Vendor Advisory |
| https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
12 Dec 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.4 |
| Summary | ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet. |
04 Dec 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Adobe coldfusion
Adobe |
|
| CWE | NVD-CWE-noinfo | |
| References | () https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
| CPE | cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2021:update8:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2021:update12:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2021:update9:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:* |
18 Mar 2024, 12:38
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-18 12:15
Updated : 2024-12-17 02:00
NVD link : CVE-2024-20767
Mitre link : CVE-2024-20767
JSON object : View
Products Affected
adobe
- coldfusion
CWE