CVE-2024-20767: Adobe ColdFusion Improper Access Control Vulnerability
Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.
Other sources
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Block public internet access to the Adobe ColdFusion admin panel. Restrict access to the admin interface for ColdFusion (including versions 2023.6, 2021.12 and earlier) to trusted IP addresses or internal networks using firewall rules, VPN, or network ACLs; do not expose the admin panel to the internet.
- Compensating control
Discontinue use of Adobe ColdFusion (for affected versions 2023.6, 2021.12 and earlier) if vendor mitigations are unavailable.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-20767?
CVE-2024-20767 is classified as a high severity vulnerability due to its potential for unauthorized access and modification of restricted files.
How do I fix CVE-2024-20767?
To fix CVE-2024-20767, update Adobe ColdFusion to the latest version that addresses the improper access control vulnerability.
What Adobe ColdFusion versions are affected by CVE-2024-20767?
CVE-2024-20767 affects Adobe ColdFusion versions 2023.6, 2021.12, and earlier.
What kind of vulnerability is CVE-2024-20767?
CVE-2024-20767 is an improper access control vulnerability that can allow attackers to breach restricted files through an exposed admin panel.
Can CVE-2024-20767 lead to data breaches?
Yes, CVE-2024-20767 can potentially lead to data breaches by allowing unauthorized access to sensitive files.