CVE-2024-20767highunder attackCWE-284

CVE-2024-20767: high-severity vulnerability in Adobe ColdFusion

ColdFusion | Improper Access Control (CWE-284)

Published · Updated

Follow this CVE+ Monitor ColdFusion

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.4epss 99%
from disclosure to weapon8 days
Published on NVDMar 18
1st PoC+8d
metasploitMar 12
CISA KEV+273d
Action required by CISAfederal deadline: 2025-01-06

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

ColdFusion has a flaw that allows attackers to read or modify files on the server if the admin panel is accessible online. This happens without needing to trick anyone into clicking something.

Technical detail

An improper access control vulnerability in ColdFusion 2023.6, 2021.12 and earlier enables arbitrary file system read/write operations when the admin panel is internet-exposed. The attack requires no user interaction and can result in unauthorized access to sensitive files and system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Adobe · ColdFusion
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Adobe ColdFusion

In the same product, most dangerous first.

CVE-2023-29300CRITICALAdobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionEPSS 100.0%KEVCVE-2018-15961CRITICALCVE-2018-15961EPSS 100.0%KEVCVE-2023-38205HIGHColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298EPSS 99.8%KEVCVE-2023-29298HIGHAdobe ColdFusion Improper Access Control Security feature bypassEPSS 99.8%KEVCVE-2023-26360HIGHAdobe ColdFusion Improper Access Control Arbitrary code executionEPSS 97.3%KEVCVE-2023-38203CRITICALAnalysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCEEPSS 97.1%KEV