CVE-2023-29298highunder attackCWE-284

CVE-2023-29298: high-severity vulnerability in Adobe ColdFusion

Adobe ColdFusion Improper Access Control Security feature bypass

Published · Updated

Follow this CVE+ Monitor ColdFusion

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

88Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.5epss 100%
from disclosure to weapon
Published on NVDJul 12
CISA KEV+8d
Action required by CISAfederal deadline: 2023-08-10

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Adobe ColdFusion has a flaw that allows attackers to bypass security controls and access administrative pages without proper authentication. This means someone could gain unauthorized control over the application without needing to trick anyone into clicking a link.

Technical detail

An improper access control vulnerability in Adobe ColdFusion (versions 2018u16 and earlier, 2021u6 and earlier, 2023.0.0.330468 and earlier) permits unauthenticated attackers to bypass security mechanisms and directly access administrative CFM and CFC endpoints. The vulnerability requires no user interaction and results in unauthorized administrative access.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Adobe · ColdFusion
Related CVEs — Adobe ColdFusion

In the same product, most dangerous first.

CVE-2023-29300CRITICALAdobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionEPSS 100.0%KEVCVE-2018-15961CRITICALCVE-2018-15961EPSS 100.0%KEVCVE-2023-38205HIGHColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298EPSS 99.8%KEVCVE-2024-20767HIGHColdFusion | Improper Access Control (CWE-284)EPSS 98.5%KEVCVE-2023-26360HIGHAdobe ColdFusion Improper Access Control Arbitrary code executionEPSS 97.3%KEVCVE-2023-38203CRITICALAnalysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCEEPSS 97.1%KEV