CVE-2024-34112: ColdFusion CFDOCUMENT file retrieval / access control bypass
ColdFusion versions 2023u7, 2021u13 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could exploit this vulnerability to gain unauthorized access to sensitive files or data. Exploitation of this issue does not require user interaction.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34112?
CVE-2024-34112 is considered a high severity vulnerability due to its potential to allow unauthorized access to sensitive files.
How do I fix CVE-2024-34112?
To fix CVE-2024-34112, update ColdFusion to the latest version that addresses this vulnerability.
What versions of ColdFusion are affected by CVE-2024-34112?
CVE-2024-34112 affects ColdFusion versions 2023u7, 2021u13, and all earlier versions.
What kind of attack can exploit CVE-2024-34112?
An attacker can exploit CVE-2024-34112 to perform arbitrary file system reads, potentially accessing sensitive data.
Is authentication bypass possible due to CVE-2024-34112?
Yes, CVE-2024-34112 involves improper access control, which could lead to an authentication bypass.