Vulnerability-Lookup

CVE-2024-45113 (GCVE-0-2024-45113)

Vulnerability from cvelistv5 – Published: 2024-09-13 09:18 – Updated: 2024-09-16 12:56

Title

ColdFusion | Improper Authentication (CWE-287)

Summary

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the application. Exploitation of this issue does not require user interaction.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-287 - Improper Authentication (CWE-287)

Assigner

adobe

References

URL

Tags

https://helpx.adobe.com/security/products/coldfus…

vendor-advisory

Impacted products

	Vendor	Product	Version
	Adobe	ColdFusion	Affected: 0 , ≤ 2021.12 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "coldfusion",
            "vendor": "adobe",
            "versions": [
              {
                "lessThanOrEqual": "2023.6",
                "status": "affected",
                "version": "2023.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "2021.12",
                "status": "affected",
                "version": "2021.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45113",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-13T14:00:33.243484Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-13T14:02:02.184Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "ColdFusion",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "2021.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2024-03-12T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the application. Exploitation of this issue does not require user interaction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "HIGH",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "NETWORK",
            "modifiedAvailabilityImpact": "NONE",
            "modifiedConfidentialityImpact": "NONE",
            "modifiedIntegrityImpact": "HIGH",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "UNCHANGED",
            "modifiedUserInteraction": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication (CWE-287)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-16T12:56:24.654Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ColdFusion | Improper Authentication (CWE-287)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2024-45113",
    "datePublished": "2024-09-13T09:18:02.435Z",
    "dateReserved": "2024-08-21T23:00:59.342Z",
    "dateUpdated": "2024-09-16T12:56:24.654Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"B02A37FE-5D31-4892-A3E6-156A8FE62D28\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*\", \"matchCriteriaId\": \"0AA3D302-CFEE-4DFD-AB92-F53C87721BFF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*\", \"matchCriteriaId\": \"EB88D4FE-5496-4639-BAF2-9F29F24ABF29\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*\", \"matchCriteriaId\": \"43E0ED98-2C1F-40B8-AF60-FEB1D85619C0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*\", \"matchCriteriaId\": \"76204873-C6E0-4202-8A03-0773270F1802\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*\", \"matchCriteriaId\": \"C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*\", \"matchCriteriaId\": \"E3A83642-BF14-4C37-BD94-FA76AABE8ADC\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"7A94B406-C011-4673-8C2B-0DD94D46CC4C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*\", \"matchCriteriaId\": \"AFD05E3A-10F9-4C75-9710-BA46B66FF6E6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:*\", \"matchCriteriaId\": \"F1FC7D1D-6DD2-48B2-980F-B001B0F24473\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:*\", \"matchCriteriaId\": \"1FA19E1D-61C2-4640-AF06-4BCFE750BDF3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2021:update12:*:*:*:*:*:*\", \"matchCriteriaId\": \"3F331DEA-F3D0-4B13-AB1E-6FE39B2BB55D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*\", \"matchCriteriaId\": \"D57C8681-AC68-47DF-A61E-B5C4B4A47663\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*\", \"matchCriteriaId\": \"75608383-B727-48D6-8FFA-D552A338A562\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*\", \"matchCriteriaId\": \"7773DB68-414A-4BA9-960F-52471A784379\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*\", \"matchCriteriaId\": \"B38B9E86-BCD5-4BCA-8FB7-EC55905184E6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*\", \"matchCriteriaId\": \"5E7BAB80-8455-4570-A2A2-8F40469EE9CC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*\", \"matchCriteriaId\": \"F9D645A2-E02D-4E82-A2BD-0A7DE5B8FBCC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2021:update8:*:*:*:*:*:*\", \"matchCriteriaId\": \"6E22D701-B038-4795-AA32-A18BC93C2B6F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:coldfusion:2021:update9:*:*:*:*:*:*\", \"matchCriteriaId\": \"CAC4A0EC-C3FC-47D8-86CE-0E6A87A7F0B0\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the application. Exploitation of this issue does not require user interaction.\"}, {\"lang\": \"es\", \"value\": \"Las versiones 2023.6, 2021.12 y anteriores de ColdFusion se ven afectadas por una vulnerabilidad de autenticaci\\u00f3n incorrecta que podr\\u00eda provocar una escalada de privilegios. Un atacante podr\\u00eda aprovechar esta vulnerabilidad para obtener acceso no autorizado y afectar la integridad de la aplicaci\\u00f3n. La explotaci\\u00f3n de este problema no requiere la interacci\\u00f3n del usuario.\"}]",
      "id": "CVE-2024-45113",
      "lastModified": "2024-09-13T16:56:53.673",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"psirt@adobe.com\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
      "published": "2024-09-13T10:15:16.737",
      "references": "[{\"url\": \"https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "psirt@adobe.com",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"psirt@adobe.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-287\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-45113\",\"sourceIdentifier\":\"psirt@adobe.com\",\"published\":\"2024-09-13T10:15:16.737\",\"lastModified\":\"2024-09-13T16:56:53.673\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the application. Exploitation of this issue does not require user interaction.\"},{\"lang\":\"es\",\"value\":\"Las versiones 2023.6, 2021.12 y anteriores de ColdFusion se ven afectadas por una vulnerabilidad de autenticaci\u00f3n incorrecta que podr\u00eda provocar una escalada de privilegios. Un atacante podr\u00eda aprovechar esta vulnerabilidad para obtener acceso no autorizado y afectar la integridad de la aplicaci\u00f3n. La explotaci\u00f3n de este problema no requiere la interacci\u00f3n del usuario.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@adobe.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"psirt@adobe.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"B02A37FE-5D31-4892-A3E6-156A8FE62D28\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0AA3D302-CFEE-4DFD-AB92-F53C87721BFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB88D4FE-5496-4639-BAF2-9F29F24ABF29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*\",\"matchCriteriaId\":\"43E0ED98-2C1F-40B8-AF60-FEB1D85619C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*\",\"matchCriteriaId\":\"76204873-C6E0-4202-8A03-0773270F1802\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3A83642-BF14-4C37-BD94-FA76AABE8ADC\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"7A94B406-C011-4673-8C2B-0DD94D46CC4C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*\",\"matchCriteriaId\":\"AFD05E3A-10F9-4C75-9710-BA46B66FF6E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1FC7D1D-6DD2-48B2-980F-B001B0F24473\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FA19E1D-61C2-4640-AF06-4BCFE750BDF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update12:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F331DEA-F3D0-4B13-AB1E-6FE39B2BB55D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*\",\"matchCriteriaId\":\"D57C8681-AC68-47DF-A61E-B5C4B4A47663\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*\",\"matchCriteriaId\":\"75608383-B727-48D6-8FFA-D552A338A562\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*\",\"matchCriteriaId\":\"7773DB68-414A-4BA9-960F-52471A784379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B38B9E86-BCD5-4BCA-8FB7-EC55905184E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E7BAB80-8455-4570-A2A2-8F40469EE9CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F9D645A2-E02D-4E82-A2BD-0A7DE5B8FBCC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update8:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E22D701-B038-4795-AA32-A18BC93C2B6F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update9:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAC4A0EC-C3FC-47D8-86CE-0E6A87A7F0B0\"}]}]}],\"references\":[{\"url\":\"https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-45113\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-13T14:00:33.243484Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*\"], \"vendor\": \"adobe\", \"product\": \"coldfusion\", \"versions\": [{\"status\": \"affected\", \"version\": \"2023.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2023.6\"}, {\"status\": \"affected\", \"version\": \"2021.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2021.12\"}], \"defaultStatus\": \"affected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-13T14:01:56.271Z\"}}], \"cna\": {\"title\": \"ColdFusion | Improper Authentication (CWE-287)\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"modifiedScope\": \"UNCHANGED\", \"temporalScore\": 7.5, \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"remediationLevel\": \"NOT_DEFINED\", \"reportConfidence\": \"NOT_DEFINED\", \"temporalSeverity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"environmentalScore\": 7.5, \"privilegesRequired\": \"NONE\", \"exploitCodeMaturity\": \"NOT_DEFINED\", \"integrityRequirement\": \"NOT_DEFINED\", \"modifiedAttackVector\": \"NETWORK\", \"confidentialityImpact\": \"NONE\", \"environmentalSeverity\": \"HIGH\", \"availabilityRequirement\": \"NOT_DEFINED\", \"modifiedIntegrityImpact\": \"HIGH\", \"modifiedUserInteraction\": \"NONE\", \"modifiedAttackComplexity\": \"LOW\", \"confidentialityRequirement\": \"NOT_DEFINED\", \"modifiedAvailabilityImpact\": \"NONE\", \"modifiedPrivilegesRequired\": \"NONE\", \"modifiedConfidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Adobe\", \"product\": \"ColdFusion\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2021.12\"}], \"defaultStatus\": \"affected\"}], \"datePublic\": \"2024-03-12T17:00:00.000Z\", \"references\": [{\"url\": \"https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the application. Exploitation of this issue does not require user interaction.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-287\", \"description\": \"Improper Authentication (CWE-287)\"}]}], \"providerMetadata\": {\"orgId\": \"078d4453-3bcd-4900-85e6-15281da43538\", \"shortName\": \"adobe\", \"dateUpdated\": \"2024-09-16T12:56:24.654Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-45113\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-16T12:56:24.654Z\", \"dateReserved\": \"2024-08-21T23:00:59.342Z\", \"assignerOrgId\": \"078d4453-3bcd-4900-85e6-15281da43538\", \"datePublished\": \"2024-09-13T09:18:02.435Z\", \"assignerShortName\": \"adobe\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

WID-SEC-W-2024-0598

Vulnerability from csaf_certbund - Published: 2024-03-12 23:00 - Updated: 2024-12-16 23:00

Summary

Adobe ColdFusion: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

ColdFusion ist ein Applikationsserver sowie Framework zur Erstellung von Web basierten Applikationen.

Angriff

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Adobe ColdFusion ausnutzen, um Informationen offenzulegen oder seine Rechte zu erweitern.

Betroffene Betriebssysteme

- Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "ColdFusion ist ein Applikationsserver sowie Framework zur Erstellung von Web basierten Applikationen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Adobe ColdFusion ausnutzen, um Informationen offenzulegen oder seine Rechte zu erweitern.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-0598 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0598.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-0598 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0598"
      },
      {
        "category": "external",
        "summary": "Adobe Security Bulletin vom 2024-03-12",
        "url": "https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html"
      },
      {
        "category": "external",
        "summary": "CISA Known Exploited Vulnerabilities Catalog vom 2024-12-16",
        "url": "https://www.cisa.gov/news-events/alerts/2024/12/16/cisa-adds-two-known-exploited-vulnerabilities-catalog"
      }
    ],
    "source_lang": "en-US",
    "title": "Adobe ColdFusion: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-12-16T23:00:00.000+00:00",
      "generator": {
        "date": "2024-12-17T09:15:27.051+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.10"
        }
      },
      "id": "WID-SEC-W-2024-0598",
      "initial_release_date": "2024-03-12T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-03-12T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-09-15T22:00:00.000+00:00",
          "number": "2",
          "summary": "CVE-2024-45113 hinzugef\u00fcgt"
        },
        {
          "date": "2024-12-16T23:00:00.000+00:00",
          "number": "3",
          "summary": "Aktive Ausnutzung gemeldet"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "2023 \u003c7",
                "product": {
                  "name": "Adobe ColdFusion 2023 \u003c7",
                  "product_id": "T033431"
                }
              },
              {
                "category": "product_version",
                "name": "2023 7",
                "product": {
                  "name": "Adobe ColdFusion 2023 7",
                  "product_id": "T033431-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:coldfusion:2023__7"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "2021 \u003c13",
                "product": {
                  "name": "Adobe ColdFusion 2021 \u003c13",
                  "product_id": "T033432"
                }
              },
              {
                "category": "product_version",
                "name": "2021 13",
                "product": {
                  "name": "Adobe ColdFusion 2021 13",
                  "product_id": "T033432-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:coldfusion:2021__13"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "ColdFusion"
          }
        ],
        "category": "vendor",
        "name": "Adobe"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-20767",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Adobe ColdFusion. Dieser Fehler besteht aufgrund einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T033431",
          "T033432"
        ]
      },
      "release_date": "2024-03-12T23:00:00.000+00:00",
      "title": "CVE-2024-20767"
    },
    {
      "cve": "CVE-2024-45113",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Adobe ColdFusion. Ein entfernter, anonymer Angreifer kann diese, nicht n\u00e4her beschriebene Schwachstelle ausnutzen, um seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T033431",
          "T033432"
        ]
      },
      "release_date": "2024-09-15T22:00:00.000+00:00",
      "title": "CVE-2024-45113"
    }
  ]
}

FKIE_CVE-2024-45113

Vulnerability from fkie_nvd - Published: 2024-09-13 10:15 - Updated: 2024-09-13 16:56

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

References

	URL	Tags
	psirt@adobe.com	https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html	Vendor Advisory

Impacted products

Vendor	Product	Version
adobe	coldfusion	2023
adobe	coldfusion	2023
adobe	coldfusion	2023
adobe	coldfusion	2023
adobe	coldfusion	2023
adobe	coldfusion	2023
adobe	coldfusion	2023
adobe	coldfusion	2021
adobe	coldfusion	2021
adobe	coldfusion	2021
adobe	coldfusion	2021
adobe	coldfusion	2021
adobe	coldfusion	2021
adobe	coldfusion	2021
adobe	coldfusion	2021
adobe	coldfusion	2021
adobe	coldfusion	2021
adobe	coldfusion	2021
adobe	coldfusion	2021
adobe	coldfusion	2021

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*",
              "matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*",
              "matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*",
              "matchCriteriaId": "EB88D4FE-5496-4639-BAF2-9F29F24ABF29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*",
              "matchCriteriaId": "43E0ED98-2C1F-40B8-AF60-FEB1D85619C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*",
              "matchCriteriaId": "76204873-C6E0-4202-8A03-0773270F1802",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*",
              "matchCriteriaId": "C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*",
              "matchCriteriaId": "E3A83642-BF14-4C37-BD94-FA76AABE8ADC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*",
              "matchCriteriaId": "7A94B406-C011-4673-8C2B-0DD94D46CC4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*",
              "matchCriteriaId": "AFD05E3A-10F9-4C75-9710-BA46B66FF6E6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:*",
              "matchCriteriaId": "F1FC7D1D-6DD2-48B2-980F-B001B0F24473",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:*",
              "matchCriteriaId": "1FA19E1D-61C2-4640-AF06-4BCFE750BDF3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update12:*:*:*:*:*:*",
              "matchCriteriaId": "3F331DEA-F3D0-4B13-AB1E-6FE39B2BB55D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*",
              "matchCriteriaId": "D57C8681-AC68-47DF-A61E-B5C4B4A47663",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*",
              "matchCriteriaId": "75608383-B727-48D6-8FFA-D552A338A562",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*",
              "matchCriteriaId": "7773DB68-414A-4BA9-960F-52471A784379",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*",
              "matchCriteriaId": "B38B9E86-BCD5-4BCA-8FB7-EC55905184E6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*",
              "matchCriteriaId": "5E7BAB80-8455-4570-A2A2-8F40469EE9CC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*",
              "matchCriteriaId": "F9D645A2-E02D-4E82-A2BD-0A7DE5B8FBCC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update8:*:*:*:*:*:*",
              "matchCriteriaId": "6E22D701-B038-4795-AA32-A18BC93C2B6F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update9:*:*:*:*:*:*",
              "matchCriteriaId": "CAC4A0EC-C3FC-47D8-86CE-0E6A87A7F0B0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the application. Exploitation of this issue does not require user interaction."
    },
    {
      "lang": "es",
      "value": "Las versiones 2023.6, 2021.12 y anteriores de ColdFusion se ven afectadas por una vulnerabilidad de autenticaci\u00f3n incorrecta que podr\u00eda provocar una escalada de privilegios. Un atacante podr\u00eda aprovechar esta vulnerabilidad para obtener acceso no autorizado y afectar la integridad de la aplicaci\u00f3n. La explotaci\u00f3n de este problema no requiere la interacci\u00f3n del usuario."
    }
  ],
  "id": "CVE-2024-45113",
  "lastModified": "2024-09-13T16:56:53.673",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-09-13T10:15:16.737",
  "references": [
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html"
    }
  ],
  "sourceIdentifier": "psirt@adobe.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "psirt@adobe.com",
      "type": "Secondary"
    }
  ]
}

GHSA-F5JX-V2MG-438V

Vulnerability from github – Published: 2024-09-13 12:30 – Updated: 2024-09-13 12:30

Details

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-45113"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-13T10:15:16Z",
    "severity": "HIGH"
  },
  "details": "ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the application. Exploitation of this issue does not require user interaction.",
  "id": "GHSA-f5jx-v2mg-438v",
  "modified": "2024-09-13T12:30:47Z",
  "published": "2024-09-13T12:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45113"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-45113 (GCVE-0-2024-45113)

WID-SEC-W-2024-0598

FKIE_CVE-2024-45113

GHSA-F5JX-V2MG-438V

Tags

Sightings

Nomenclature