Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Adobe ColdFusion ausnutzen, um Informationen offenzulegen oder seine Rechte zu erweitern.
Product
ColdFusion ist ein Applikationsserver sowie Framework zur Erstellung von Web basierten Applikationen.
Vulnerabilities 2
-
High 7.4
ColdFusion | Improper Access Control (CWE-284)
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this …
KEV Dec 16, 2024 -
High 7.5
ColdFusion | Improper Authentication (CWE-287)
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the applic…
Revision history
-
#3
Aktive Ausnutzung gemeldet
-
#2
CVE-2024-45113 hinzugefügt
-
#1
Initiale Fassung
References
-
Adobe Security Bulletin vom 2024-03-12
https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html
-
CISA Known Exploited Vulnerabilities Catalog vom 2024-12-16
https://www.cisa.gov/news-events/alerts/2024/12/16/cisa-adds-two-known-exploited-vulnerabilities-catalog