- Description
- ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.
- Source
- psirt@adobe.com
- NVD status
- Analyzed
CVSS 3.1
- Type
- Primary
- Base score
- 7.4
- Impact score
- 5.2
- Exploitability score
- 2.2
- Vector string
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity
- HIGH
Data from CISA
- Vulnerability name
- Adobe ColdFusion Improper Access Control Vulnerability
- Exploit added on
- Dec 16, 2024
- Exploit action due
- Jan 6, 2025
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- psirt@adobe.com
- CWE-284
- nvd@nist.gov
- NVD-CWE-noinfo
- Hype score
- Not currently trending
A new #vulnerability in #AdobeColdFusion (CVE-2024-20767) allows attackers to read and write system files, affecting over 200,000 exposed servers. Learn how to protect your system now: https://t.co/TErfVxlcUU #CybersecurityThreatAdvisory
@SmarterMSP
30 Dec 2024
46 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
🔴 #Adobe ColdFusion Improper Access Control Vulnerability (#CVE-2024-20767) - Critical https://t.co/3THcHRi1ln
@dailycve
30 Dec 2024
27 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
سازمان CISA در مورد دو آسیب پذیری با کد شناسایی CVE-2024-20767 و CVE-2024-35250 هشدار داد. آسیب پذیری اول مربوط به محصول ColdFusion بوده که اجازه می دهد فایل ها را read کنند. آسیب پذیری دوم مربوط به kernel ویندوز بوده و از نوع privilege escalation می باشد. https://t.co/Poz3aKYxT1
@AmirHossein_sec
18 Dec 2024
33 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2024-29404 is getting exploited #inthewild. Find out more at https://t.co/sjnUIFDV9P CVE-2024-35250 is getting exploited #inthewild. Find out more at https://t.co/HHQD5WeiX8 CVE-2024-20767 is getting exploited #inthewild. Find out more at https://t.co/QmVvFhkoSA
@inthewildio
18 Dec 2024
17 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
#DOYOUKNOWCVE CISA ALERT! Two critical vulnerabilities added to the CISA KEV catalog. CVE-2024-20767: Adobe ColdFusion Improper Access Control Vulnerability. This flaw arises from improper access control mechanisms, allowing unauthorized users to perform arbitrary file system…
@Loginsoft_Inc
18 Dec 2024
56 Impressions
2 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
We added #Adobe ColdFusion and #Microsoft #Windows kernel vulnerabilities CVE-2024-20767 & CVE-2024-35250 to our Known Exploited Vulnerabilities Catalog. Visit https://t.co/P5CinqZV68 & apply mitigations to protect your org from cyberattacks.
@byt3n33dl3
17 Dec 2024
69 Impressions
0 Retweets
0 Likes
1 Bookmark
1 Reply
0 Quotes
🚨 CISA warns U.S. federal agencies of ongoing attacks exploiting Windows kernel flaw (CVE-2024-35250) for SYSTEM privileges. Adobe ColdFusion vulnerability (CVE-2024-20767) also actively exploited. 🔒 #WindowsKernelExploitation #CVE2024 #CybersecurityNe… https://t.co/kToU7hlWjN
@TweetThreatNews
17 Dec 2024
37 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
Critical Windows and Adobe ColdFusion Vulnerabilities Actively Exploited in the Wild, PoC Exploit Published Urgent warning: CVE-2024-35250 & CVE-2024-20767 are being actively exploited by malicious actors. Take action now to protect your system https://t.co/o4AOCqctZa
@the_yellow_fall
17 Dec 2024
359 Impressions
4 Retweets
4 Likes
6 Bookmarks
0 Replies
1 Quote
csirt_it: ‼️ #Adobe: rilevato lo sfruttamento attivo in rete della CVE-2024-20767, relativa a #ColdFusion ⚠️ Ove non provveduto, si raccomanda l’aggiornamento tempestivo del software interessato 🔗 https://t.co/4Nj8RlcqGM https://t.co/W9LXvNvLwp
@Vulcanux_
16 Dec 2024
29 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
‼️ #Adobe: rilevato lo sfruttamento attivo in rete della CVE-2024-20767, relativa a #ColdFusion ⚠️ Ove non provveduto, si raccomanda l’aggiornamento tempestivo del software interessato 🔗 https://t.co/ERa98AoUtK https://t.co/GnTH1UZbnv
@csirt_it
16 Dec 2024
23 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Latest Known Exploited Vulnerabilities (#KEV) : #CVE-2024-20767 #Adobe #ColdFusion Improper Access Control Vulnerability https://t.co/wZdd36sQJk
@ScyScan
16 Dec 2024
6 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CISA Adds Two Known Exploited Vulnerability to Catalog: CVE-2024-20767 - Adobe ColdFusion Improper Access Control CVE-2024-35250 - Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference https://t.co/wO1JEcVjy5 https://t.co/E9q6jwvjOB
@TMJIntel
16 Dec 2024
85 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🔴 ColdFusion Improper Access Control (#CVE-2024-20767) - HIGH https://t.co/A6jw6G20Pn
@dailycve
16 Dec 2024
36 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Remediation for CVE-2024-20767 and CVE-2024-21216 Potential Exploitable Bugs https://t.co/AIqOWUDHt1
@_r_netsec
19 Nov 2024
1431 Impressions
5 Retweets
12 Likes
7 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A94B406-C011-4673-8C2B-0DD94D46CC4C"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AFD05E3A-10F9-4C75-9710-BA46B66FF6E6"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F1FC7D1D-6DD2-48B2-980F-B001B0F24473"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1FA19E1D-61C2-4640-AF06-4BCFE750BDF3"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update12:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3F331DEA-F3D0-4B13-AB1E-6FE39B2BB55D"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D57C8681-AC68-47DF-A61E-B5C4B4A47663"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "75608383-B727-48D6-8FFA-D552A338A562"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7773DB68-414A-4BA9-960F-52471A784379"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B38B9E86-BCD5-4BCA-8FB7-EC55905184E6"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E7BAB80-8455-4570-A2A2-8F40469EE9CC"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F9D645A2-E02D-4E82-A2BD-0A7DE5B8FBCC"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6E22D701-B038-4795-AA32-A18BC93C2B6F"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CAC4A0EC-C3FC-47D8-86CE-0E6A87A7F0B0"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB88D4FE-5496-4639-BAF2-9F29F24ABF29"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "43E0ED98-2C1F-40B8-AF60-FEB1D85619C0"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "76204873-C6E0-4202-8A03-0773270F1802"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7"
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E3A83642-BF14-4C37-BD94-FA76AABE8ADC"
}
],
"operator": "OR"
}
]
}
]