CVE-2024-34112

HIGH Year: 2024
CVSS v3 Score
7.5
High
Weakness Type
CWE-284
View all →

Vulnerability Description

ColdFusion versions 2023u7, 2021u13 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could exploit this vulnerability to gain unauthorized access to sensitive files or data. Exploitation of this issue does not require user interaction.

Related Vulnerabilities

CVE-2010-2232

HIGH
CVSS:7.5(High)

In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file.

CWE-2842010

CVE-2012-4380

HIGH
CVSS:7.5(High)

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.

CWE-2842012

CVE-2013-2972

HIGH
CVSS:7.5(High)

IBM WebSphere Cast Iron 6.3 allows remote attackers to bypass intended access restrictions via unspecified vectors. IBM X-Force ID: 83868.

CWE-2842013

CVE-2014-3929

HIGH
CVSS:7.5(High)

The default configuration for Cougar-LG stores sensitive information under the web root with insufficient access control, which might allow remote attackers to obtain private ssh keys.

CWE-2842014

CVE-2014-3930

HIGH
CVSS:7.5(High)

lg.pl in Cistron-LG 1.01 stores sensitive information under the web root with insufficient access controls, which allows remote attackers to obtain IP addresses and other unspecified router credential...

CWE-2842014

CVE-2014-9504

HIGH
CVSS:7.5(High)

The OG Subgroups module, when used with the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal, allows remote attackers to access child groups via vectors related to membership inheritance.

CWE-2842014