title: ColdFusion CFIDE Improper Access Control Leads To Privilege Escalation
description: ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment.
problem types: Improper Access Control (CWE-284)
affected:
{
defaultStatus: affected
product: ColdFusion
vendor: Adobe
versions:
lessThanOrEqual: 2018.11, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
availabilityRequirement: NOT_DEFINED
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 7.4
environmentalSeverity: HIGH
exploitCodeMaturity: NOT_DEFINED
integrityImpact: LOW
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: NETWORK
modifiedAvailabilityImpact: LOW
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: LOW
modifiedPrivilegesRequired: LOW
modifiedScope: NOT_DEFINED
modifiedUserInteraction: NONE
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 7.4
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL