CVE-2021-40699: ColdFusion CFIDE Improper Access Control Leads To Privilege Escalation
First published: Thu Sep 07 2023(Updated: )
ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment.
Credit: psirt@adobe.com psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe ColdFusion | <2018 | |
| Adobe ColdFusion | =2018 | |
| Adobe ColdFusion | =2018-update1 | |
| Adobe ColdFusion | =2018-update10 | |
| Adobe ColdFusion | =2018-update2 | |
| Adobe ColdFusion | =2018-update3 | |
| Adobe ColdFusion | =2018-update4 | |
| Adobe ColdFusion | =2018-update5 | |
| Adobe ColdFusion | =2018-update6 | |
| Adobe ColdFusion | =2018-update7 | |
| Adobe ColdFusion | =2018-update8 | |
| Adobe ColdFusion | =2018-update9 | |
| Adobe ColdFusion | =2021 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-40699.
What is the severity of CVE-2021-40699?
The severity of CVE-2021-40699 is high with a CVSS score of 7.4.
Which software versions are affected by CVE-2021-40699?
ColdFusion versions 2018.10 and earlier, as well as ColdFusion 2021 update 1 and earlier, are affected by CVE-2021-40699.
What is the impact of CVE-2021-40699?
CVE-2021-40699 allows an authenticated attacker to access and manipulate arbitrary data on the environment.
How can I fix CVE-2021-40699?
To fix CVE-2021-40699, update ColdFusion to a version that is not affected by the vulnerability.
- collector/nvd-api
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/severity
- agent/title
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- vendor/adobe
- canonical/adobe coldfusion
- version/adobe coldfusion/2018
- version/adobe coldfusion/2018-update1
- version/adobe coldfusion/2018-update10
- version/adobe coldfusion/2018-update2
- version/adobe coldfusion/2018-update3
- version/adobe coldfusion/2018-update4
- version/adobe coldfusion/2018-update5
- version/adobe coldfusion/2018-update6
- version/adobe coldfusion/2018-update7
- version/adobe coldfusion/2018-update8
- version/adobe coldfusion/2018-update9
- version/adobe coldfusion/2021