What is CVE-2021-40699?

CVE-2021-40699 is a high-severity vulnerability in Adobe Coldfusion, classified under Improper Access Control. CVSS score: 7.4/10. Published 2023-09-07.

How severe is CVE-2021-40699?

High severity. CVSS v3 base score is 7.4 out of 10.

Vulnerability in Adobe Coldfusion

CVE-2021-40699

ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment.

EPSS: 0.005 (39.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L.

Affected products

Adobe Coldfusion — versions 2018, 0, 2021

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

psirt@adobe.com (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2021-40699?: CVE-2021-40699 is a high-severity vulnerability in Adobe Coldfusion, classified under Improper Access Control. CVSS score: 7.4/10. Published 2023-09-07.
How severe is CVE-2021-40699?: High severity. CVSS v3 base score is 7.4 out of 10.