// For flags

CVE-2021-40698

ColdFusion Use of Inherently Dangerous Function Leads To Security feature bypass  

Severity Score

7.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an Use of Inherently Dangerous Function vulnerability that can lead to a security feature bypass  . An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment.

ColdFusion versión 2021 update 1 (y anteriores) y las versiones 2018.10 (y anteriores) se ven afectadas por una vulnerabilidad de uso de funciones inherentemente peligrosas que puede provocar una omisión de característica de seguridad (previsiblemente). Un atacante autenticado podría aprovechar esta vulnerabilidad para obtener acceso y manipular datos arbitrarios en el entorno.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2021-09-08 CVE Reserved
  • 2023-09-07 CVE Published
  • 2024-09-04 CVE Updated
  • 2024-09-13 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-242: Use of Inherently Dangerous Function
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Adobe
Search vendor "Adobe"
Coldfusion
Search vendor "Adobe" for product "Coldfusion"
< 2018
Search vendor "Adobe" for product "Coldfusion" and version " < 2018"
-
Affected
Adobe
Search vendor "Adobe"
Coldfusion
Search vendor "Adobe" for product "Coldfusion"
2018
Search vendor "Adobe" for product "Coldfusion" and version "2018"
-
Affected
Adobe
Search vendor "Adobe"
Coldfusion
Search vendor "Adobe" for product "Coldfusion"
2018
Search vendor "Adobe" for product "Coldfusion" and version "2018"
update1
Affected
Adobe
Search vendor "Adobe"
Coldfusion
Search vendor "Adobe" for product "Coldfusion"
2018
Search vendor "Adobe" for product "Coldfusion" and version "2018"
update10
Affected
Adobe
Search vendor "Adobe"
Coldfusion
Search vendor "Adobe" for product "Coldfusion"
2018
Search vendor "Adobe" for product "Coldfusion" and version "2018"
update2
Affected
Adobe
Search vendor "Adobe"
Coldfusion
Search vendor "Adobe" for product "Coldfusion"
2018
Search vendor "Adobe" for product "Coldfusion" and version "2018"
update3
Affected
Adobe
Search vendor "Adobe"
Coldfusion
Search vendor "Adobe" for product "Coldfusion"
2018
Search vendor "Adobe" for product "Coldfusion" and version "2018"
update4
Affected
Adobe
Search vendor "Adobe"
Coldfusion
Search vendor "Adobe" for product "Coldfusion"
2018
Search vendor "Adobe" for product "Coldfusion" and version "2018"
update5
Affected
Adobe
Search vendor "Adobe"
Coldfusion
Search vendor "Adobe" for product "Coldfusion"
2018
Search vendor "Adobe" for product "Coldfusion" and version "2018"
update6
Affected
Adobe
Search vendor "Adobe"
Coldfusion
Search vendor "Adobe" for product "Coldfusion"
2018
Search vendor "Adobe" for product "Coldfusion" and version "2018"
update7
Affected
Adobe
Search vendor "Adobe"
Coldfusion
Search vendor "Adobe" for product "Coldfusion"
2018
Search vendor "Adobe" for product "Coldfusion" and version "2018"
update8
Affected
Adobe
Search vendor "Adobe"
Coldfusion
Search vendor "Adobe" for product "Coldfusion"
2018
Search vendor "Adobe" for product "Coldfusion" and version "2018"
update9
Affected
Adobe
Search vendor "Adobe"
Coldfusion
Search vendor "Adobe" for product "Coldfusion"
2021
Search vendor "Adobe" for product "Coldfusion" and version "2021"
-
Affected