CVE-2014-0572: Medium severity adobe coldfusion vulnerability

Published Oct 15, 2014

Updated

Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows local users to bypass intended IP-based access restrictions via unspecified vectors.

Affected Software

18 affected components

Adobe ColdFusion=9.0

Adobe ColdFusion=9.0-update_10

Adobe ColdFusion=9.0-update_12

Adobe ColdFusion=9.0.1

Adobe ColdFusion=9.0.1-update_11

Adobe ColdFusion=9.0.1-update_9

Adobe ColdFusion=9.0.2

Adobe ColdFusion=9.0.2-update_4

Adobe ColdFusion=9.0.2-update_6

Adobe ColdFusion=10.0

Adobe ColdFusion=10.0-update1

Adobe ColdFusion=10.0-update11

Adobe ColdFusion=10.0-update12

Adobe ColdFusion=10.0-update2

Adobe ColdFusion=10.0-update3

Adobe ColdFusion=10.0-update4

Adobe ColdFusion=10.0-update8

Adobe ColdFusion=11.0

Remediation

Patch Available

http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html

Event History

Oct 15, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-0572?

CVE-2014-0572 is classified as a medium-severity vulnerability that allows local users to bypass IP-based access restrictions.

How do I fix CVE-2014-0572?

To fix CVE-2014-0572, update Adobe ColdFusion to the latest version or apply the security updates that address this vulnerability.

What versions of Adobe ColdFusion are affected by CVE-2014-0572?

CVE-2014-0572 affects Adobe ColdFusion versions 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2.

Can CVE-2014-0572 be exploited remotely?

CVE-2014-0572 is a local vulnerability, meaning it requires local access to the system to exploit.

What types of attacks can be conducted due to CVE-2014-0572?

Due to CVE-2014-0572, local users could potentially gain unauthorized access to services restricted by IP-based controls.