CVE-2024-20767 kev in the critical feed json
ColdFusion | Improper Access Control (CWE-284)
published 2024-03-18 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-18482
- cvss
- 7.4
- version 3.1, CNA
- cisa kev
- Exploited
- added 2024-12-16
- epss
- 98.5%
- EPSS 98.5% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 2
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.
Patch / fix
cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- adobe coldfusion 2021.13, 2023.7
Timeline
- First public exploit (Metasploit auxiliary/gather/coldfusion_pms_servlet_file_read)
- Published
- Added to CISA KEV
- CISA SSVC: exploitation active
- CISA patch deadline
Known exploited
- Added
- 22 mo ago
- Patch by
- 2025-01-06 (22 mo ago)
- Ransomware
- Not known
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Vendor, product
- Adobe, ColdFusion
- CISA name
- Adobe ColdFusion Improper Access Control Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 22 mo ago
Exploit prediction
98.51% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/gather/coldfusion_pms_servlet_file_read CVE-2024-20767 - Adobe Coldfusion Arbitrary File Read metasploit auxiliary, normal rank, 2024-03-12
- EDB-52387 Adobe ColdFusion 2023.6 - Remote File Read webapps, 2025-07-28
- Nuclei template Adobe ColdFusion - Arbitrary File Read nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected products
- Adobe ColdFusion
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
helpx.adobe.com
/security/products/coldfusion/apsb24-14.html
vendor-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20767
government-resource, third-party-advisory, us-government-resource
Sources
- CVE List CVE-2024-20767
- NVD CVE-2024-20767
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.