# CVE-2024-20767

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.

- Page: https://www.vulneraibility.com/cve/CVE-2024-20767
- CVSS: 7.4
- Known exploited: yes, in CISA KEV since 2024-12-16; CISA due date 2025-01-06
- EPSS: 98.51%
- Public exploit code: 1 on Exploit-DB · 1 Metasploit module · 5 GitHub proofs of concept · 1 Nuclei template (first 2024-03-26)
- CISA SSVC: exploitation active, automatable yes, technical impact partial (assessed 2024-12-17)
- Weakness: CWE-284
- Published: 2024-03-18

## Affected versions

- Adobe ColdFusion: affected <= 2021.12

A version outside these ranges is not a statement that it is unaffected.

## References

- [advisory] https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20767

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.