CVE-2024-20767

Adobe ColdFusion Improper Access Control Vulnerability

Adobe — ColdFusion

Added to KEV catalog: 16 December 2024
Federal remediation due date: 6 January 2025
Weakness classification (CWE): CWE-284

CISA Description

Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-20767

View on NVD View on MITRE CVE View full CISA catalog

More Adobe Vulnerabilities

CVE-2026-48282

Adobe ColdFusion Path Traversal Vulnerability

CVE-2009-3459

Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

CVE-2020-9715

Adobe Acrobat Use-After-Free Vulnerability

CVE-2026-34621

Adobe Acrobat and Reader Prototype Pollution Vulnerability

CVE-2025-54236

Adobe Commerce and Magento Improper Input Validation Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services