CVE-2021-40699CWE-284

ColdFusion CFIDE Improper Access Control Leads To Privilege Escalation

High · published September 7, 2023

CVSS v3.1
7.4
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00509 · 42.6th percentile
Weakness
CWE-284 · Improper Access Control
Published
2023-09-07T12:54Z
EPSS history
Timeline
  • 07 SEP 12:54Z
    ColdFusion CFIDE Improper Access Control Leads To Privilege Escalation
    cvelistv5