CVE-2024-20767

Katalog CVE

CVSS 7.4 · High KEV · sudah dieksploitasi EPSS 98,5%

Kerentanan Improper Access Control pada adobe coldfusion. Skor CVSS 3.1 7.4 (High) menurut adobe.com. Masuk katalog KEV CISA pada 16 Desember 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.

Rincian

Terbit di NVD

18 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.4 (High), sumber adobe.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

98,5% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Adobe ColdFusion Improper Access Control Vulnerability

Masuk KEV

16 Desember 2024

Tenggat CISA

6 Januari 2025 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20767 advisory pihak ketiga · pemerintah AS