title: ColdFusion Use of Inherently Dangerous Function Leads To Security feature bypass
description: ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an Use of Inherently Dangerous Function vulnerability that can lead to a security feature bypass  . An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment.
problem types: Use of Inherently Dangerous Function (CWE-242)
affected:
{
defaultStatus: affected
product: ColdFusion
vendor: Adobe
versions:
lessThanOrEqual: 2018.11, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
availabilityRequirement: NOT_DEFINED
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 7.4
environmentalSeverity: HIGH
exploitCodeMaturity: NOT_DEFINED
integrityImpact: LOW
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: NETWORK
modifiedAvailabilityImpact: LOW
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: LOW
modifiedPrivilegesRequired: LOW
modifiedScope: NOT_DEFINED
modifiedUserInteraction: NONE
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 7.4
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL