CVE-2024-34113: ColdFusion | Weak Cryptography for Passwords (CWE-261)
ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vulnerability that could result in a security feature bypass. This vulnerability arises due to the use of insufficiently strong cryptographic algorithms or flawed implementation that compromises the confidentiality of password data. An attacker could exploit this weakness to decrypt or guess passwords, potentially gaining unauthorized access to protected resources. Exploitation of this issue does not require user interaction.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34113?
CVE-2024-34113 is a medium severity vulnerability characterized by weak cryptography for passwords.
How do I fix CVE-2024-34113?
To mitigate CVE-2024-34113, update your Adobe ColdFusion to the latest version that addresses this vulnerability.
Which versions of ColdFusion are affected by CVE-2024-34113?
CVE-2024-34113 affects Adobe ColdFusion versions 2023u7, 2021u13, and earlier.
What impact does CVE-2024-34113 have on security?
CVE-2024-34113 may lead to a security feature bypass due to the use of weak cryptographic algorithms.
Is any additional configuration needed after updating for CVE-2024-34113?
After updating for CVE-2024-34113, review your password policies to ensure they're compliant with best practices for cryptography.