CVE-2024-20767
ColdFusion | Improper Access Control (CWE-284)
- Published
- Mar 18, 2024
- Updated
- Oct 21, 2025
- Assigning CNA
- adobe
- Evidence observed
- Dec 16, 2024
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NHigh · next 30 days
- Percentile
- 99.9%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.
Sources
5PoC exploit for CVE-2024-20767 in Adobe ColdFusion, leveraging an improper access control flaw to read arbitrary files from affected servers.
Python PoC exploit for CVE-2024-20767 enabling arbitrary file read on vulnerable Adobe ColdFusion servers via the Performance Monitoring Toolset endpoint.
- CVE-2024-20767Exploit
Exploit for CVE-2024-20767 - Adobe ColdFusion
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.