CVE-2023-29300criticalunder attackransomwareCWE-502

CVE-2023-29300: critical vulnerability in Adobe ColdFusion

Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

Published · Updated

95Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon
Published on NVDJul 12
CISA KEV+180d
exploitation probability
100%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
1 group(s)
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateStorm-0501 MITRE ATT&CK
Action required by CISAfederal deadline: 2024-01-29

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Adobe ColdFusion has a flaw that allows attackers to run malicious code on servers by sending specially crafted data. This happens without needing to trick users and puts all affected servers at serious risk.

Technical detail

CVE-2023-29300 exploits unsafe deserialization of untrusted data in Adobe ColdFusion, enabling remote code execution without user interaction. The vulnerability affects versions 2018u16 and earlier, 2021u6 and earlier, and 2023.0.0.330468 and earlier; attackers can craft malicious serialized objects to achieve arbitrary code execution on the target system.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Adobe · ColdFusion
Related CVEs — Adobe ColdFusion

In the same product, most dangerous first.

CVE-2018-15961CRITICALCVE-2018-15961EPSS 100.0%KEVCVE-2023-29298HIGHAdobe ColdFusion Improper Access Control Security feature bypassEPSS 99.8%KEVCVE-2023-38205HIGHColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298EPSS 99.8%KEVCVE-2024-20767HIGHColdFusion | Improper Access Control (CWE-284)EPSS 98.5%KEVCVE-2023-26360HIGHAdobe ColdFusion Improper Access Control Arbitrary code executionEPSS 97.3%KEVCVE-2023-38203CRITICALAnalysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCEEPSS 97.1%KEV
References
https://helpx.adobe.com/security/products/coldfusion/apsb23-40.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29300