{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/coldfusion-2023--update-6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:adobe:coldfusion:2021:*:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2023:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2024-20767"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ColdFusion (2021 \u003c= Update 12)","ColdFusion (2023 \u003c= Update 6)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","remote-file-read","webserver"],"_cs_type":"threat","_cs_vendors":["Adobe"],"content_html":"\u003cp\u003eCVE-2024-20767 is a critical arbitrary file read vulnerability affecting Adobe ColdFusion 2021 (Update 12 and earlier) and Adobe ColdFusion 2023 (Update 6 and earlier). The vulnerability stems from improper access control mechanisms within the application, enabling unauthenticated remote attackers to bypass security restrictions and read sensitive files from the server's filesystem.\u003c/p\u003e\n\u003cp\u003eThe issue has been identified as being actively exploited in the wild, with multiple functional proof-of-concept (PoC) exploit scripts publicly available. These scripts allow attackers to target specific file paths on the server, potentially exposing configuration files, credential stores, or system data. Given the high EPSS score and public availability of exploits, immediate patching to the latest available update is required to mitigate the risk of unauthorized data exfiltration.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify internet-facing Adobe ColdFusion servers.\u003c/li\u003e\n\u003cli\u003eAttacker probes the target for the presence of the vulnerable ColdFusion interface, commonly listening on port 8500.\u003c/li\u003e\n\u003cli\u003eAttacker sends a specially crafted HTTP request to the web application exploiting the improper access control flaw.\u003c/li\u003e\n\u003cli\u003eThe application processes the request, failing to validate or restrict access to requested filesystem resources.\u003c/li\u003e\n\u003cli\u003eThe server responds with the contents of the requested sensitive file.\u003c/li\u003e\n\u003cli\u003eAttacker captures the file contents to extract system information or sensitive credentials.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to read any file accessible by the ColdFusion service process. This leads to full exposure of application configuration files, including database connection strings, authentication secrets, and potentially operating system sensitive data, facilitating further compromise of the internal environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update Adobe ColdFusion 2021 to Update 13 or later and Adobe ColdFusion 2023 to Update 7 or later.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous requests to ColdFusion endpoints containing path traversal sequences or attempts to access system-level files.\u003c/li\u003e\n\u003cli\u003eApply the updates documented in Adobe Security Bulletin APSB24-14 to resolve the underlying access control vulnerability.\u003c/li\u003e\n\u003cli\u003eEnsure that ColdFusion instances are not exposed to the public internet; restrict access to authorized management IPs only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T10:43:28Z","date_published":"2026-10-13T10:43:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-20767/","summary":"CVE-2024-20767 is a critical arbitrary file read vulnerability in Adobe ColdFusion caused by improper access control, allowing unauthenticated attackers to exfiltrate sensitive files from the host server.","title":"Adobe ColdFusion Arbitrary File Read (CVE-2024-20767)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-20767/"}],"language":"en","title":"CraftedSignal Threat Feed - ColdFusion (2023 \u003c= Update 6)","version":"https://jsonfeed.org/version/1.1"}