ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.

Adobe ColdFusion prior to versions 2021 Update 13 or 2023 Update 7, suffer from an Improper Access Control vulnerability that could lead to arbitrary file system read. By leveraging this vulnerability, a remote unauthenticated attacker can access to sensitive files and perform arbitrary file system write.

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2021.x update 13 or 2023.x update 7. It is, therefore, affected by a vulnerability as referenced in the APSB24-14 advisory.

  - Improper Access Control (CWE-284) potentially leading to Arbitrary file system read (CVE-2024-20767)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
114259	Adobe ColdFusion Arbitrary File Read	Web App Scanning	Component Vulnerability	Check Based	high
192100	Adobe ColdFusion < 2021.x < 2021u13 / 2023.x < 2023u7 Vulnerability (APSB24-14)	Nessus	Windows	Local	high

Detections

Analytics

CVE-2024-20767

high

Tenable Plugins

high

high