Vulnerability record · CVE-2024-20767 · published 18 March 2024
CVE-2024-20767: Adobe ColdFusion improper access control allows arbitrary file read
Adobe · Coldfusion
ColdFusion versions 2023.6, 2021.12 and earlier contain an improper access control flaw that permits arbitrary file system read. Because the admin panel must be internet-exposed for exploitation, the flaw matters most for organizations that publish ColdFusion administration interfaces directly to the internet.
Description
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Automated analysis
critical priorityThe flaw is in CISA KEV with near-maximum EPSS and allows unauthenticated arbitrary file read and modification when the admin panel is internet-facing.
What it is
ColdFusion versions 2023.6, 2021.12 and earlier contain an improper access control flaw that permits arbitrary file system read. Because the admin panel must be internet-exposed for exploitation, the flaw matters most for organizations that publish ColdFusion administration interfaces directly to the internet.
Impact
An attacker can read restricted files on the server and, per the description, potentially modify them, exposing configuration, credentials or other sensitive data.
Attack surface
Reachable over the network via the ColdFusion admin panel; no authentication or user interaction is required, but the admin panel must be exposed to the internet.
Exploitation
Listed in CISA KEV since 2024-12-16 with a very high EPSS probability (0.985, 99.9th percentile), indicating active exploitation in the wild; no ransomware campaign use is documented.
What to do
- Apply the Adobe ColdFusion updates referenced in advisory APSB24-14 for versions 2023.6, 2021.12 and earlier.
- Remove internet exposure of the ColdFusion administrator panel; restrict it to trusted management networks or VPN.
- If patching is not immediately possible, follow CISA KEV required actions or discontinue use of the affected product.
- Audit and rotate credentials and secrets stored in files reachable through the exposed admin interface.
Detection
- Monitor web logs for requests to ColdFusion administrator endpoints from unexpected external source IPs.
- Alert on anomalous file read activity by the ColdFusion service account, especially access to configuration or credential files.
- Review for unexpected changes to files accessible via the admin panel that could indicate modification attempts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2024-20767 to the Known Exploited Vulnerabilities catalog on 16 December 2024 as "Adobe ColdFusion Improper Access Control Vulnerability". Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 6 January 2025.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html | Vendor Advisory |
| https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20767 | Third Party AdvisoryUS Government Resource |
Track CVE-2024-20767 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-20767), CISA KEV, FIRST EPSS (scores of 2026-09-19). This page is refreshed as NVD updates the record.
