PT-2024-9816 · Adobe · Coldfusion
Published
2024-11-25
·
Updated
2025-03-17
·
CVE-2024-53961
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
ColdFusion versions 2023.11, 2021.17 and earlier
Description:
The issue is related to an improper limitation of a pathname to a restricted directory, also known as a path traversal vulnerability. This could allow an attacker to access files or directories outside of the restricted directory set by the application, potentially leading to the disclosure of sensitive information or the manipulation of system data. It is estimated that over 8.5 million services are potentially affected. A proof-of-concept exploit code is available, and experts warn of potential attacks.
Recommendations:
For ColdFusion versions 2023.11, 2021.17 and earlier: Apply the out-of-band security updates released by Adobe to address the critical path traversal vulnerability. As a temporary workaround, consider restricting access to sensitive files and directories until the patch is applied.
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Coldfusion