CVE-2023-20767
published 2023-07-04CVE-2023-20767: In pqframework, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution…
PriorityP428medium6.7CVSS 3.1
AVLACLPRHUINSUCHIHAH
EPSS
0.11%
1.8th percentile
In pqframework, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629585; Issue ID: ALPS07629584.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Adobe ColdFusion 2023.6 - Remote File Read
exploitdb·2025-07-28·CVSS 7.4
CVE-2024-20767 [HIGH] Adobe ColdFusion 2023.6 - Remote File Read
Adobe ColdFusion 2023.6 - Remote File Read
---
# Exploit Title: Adobe ColdFusion 2023.6 - Remote File Read
# Exploit Author: @İbrahimsql
# Exploit Author's github: https://github.com/ibrahmsql
# Description: ColdFusion 2023 (LUcee) - Remote Code Execution
# CVE: CVE-2024-20767
# Vendor Homepage: https://www.adobe.com/
# Requirements: requests>=2.25.0, urllib3>=1.26.0
# Usage: python3 CVE-2024-20767.py -u http://target.com -f /etc/passwd
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import os
import re
import urllib3
import requests
import argparse
from urllib.parse import urlparse
from concurrent.futures import ThreadPoolExecutor, as_completed
urllib3.disable_warnings()
class ColdFusionExploit:
def __init__(self, output_file=None, port=8500):
self.output_file = output_file
self.port
Nuclei
Adobe ColdFusion - Arbitrary File Read
nuclei·CVSS 7.4
CVE-2024-20767 [HIGH] Adobe ColdFusion - Arbitrary File Read
Adobe ColdFusion - Arbitrary File Read
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to sensitive files and perform arbitrary file system write. Exploitation of this issue does not require user interaction.
Template:
id: CVE-2024-20767
info:
name: Adobe ColdFusion - Arbitrary File Read
author: iamnoooob,rootxharsh,pdresearch
severity: high
description: |
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to bypass security measures and
Metasploit
CVE-2024-20767 - Adobe Coldfusion Arbitrary File Read
metasploit·CVSS 7.4
CVE-2024-20767 [HIGH] CVE-2024-20767 - Adobe Coldfusion Arbitrary File Read
CVE-2024-20767 - Adobe Coldfusion Arbitrary File Read
This module exploits an Improper Access Vulnerability in Adobe Coldfusion versions prior to version '2023 Update 6' and '2021 Update 12'. The vulnerability allows unauthenticated attackers to request authentication token in the form of a UUID from the /CFIDE/adminapi/_servermanager/servermanager.cfc endpoint. Using that UUID attackers can hit the /pms endpoint in order to exploit the Arbitrary File Read Vulnerability.
No writeups or analysis indexed.
2023-07-04
Published