Lucene search

AdobeCVELIST:CVE-2024-34112

HistoryJun 13, 2024 - 11:27 a.m.

CVE-2024-34112 ColdFusion CFDOCUMENT file retrieval / access control bypass

2024-06-1311:27:15

CWE-284

adobe

www.cve.org

coldfusion

vulnerability

file retrieval

access control bypass

improper access control

arbitrary file system read

unauthorized access

sensitive files

data

exploitation issue

user interaction

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

37.2%

JSON

ColdFusion versions 2023u7, 2021u13 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could exploit this vulnerability to gain unauthorized access to sensitive files or data. Exploitation of this issue does not require user interaction.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "ColdFusion",
    "vendor": "Adobe",
    "versions": [
      {
        "lessThanOrEqual": "2021u13",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

helpx.adobe.com/security/products/coldfusion/apsb24-41.html

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

37.2%

JSON

Related for CVELIST:CVE-2024-34112