CVE-2023-38203criticalunder attackransomwareCWE-502

CVE-2023-38203: critical vulnerability in Adobe ColdFusion

Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE

Published · Updated

95Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 9.8epss 97%
from disclosure to weapon
Published on NVDJul 20
CISA KEV+172d
exploitation probability
97%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
1 group(s)
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateStorm-0501 MITRE ATT&CK
Action required by CISAfederal deadline: 2024-01-29

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Adobe ColdFusion has a critical flaw that allows attackers to run malicious code on vulnerable servers without any user interaction. This happens because the software unsafely processes untrusted data, giving attackers a direct path into the system.

Technical detail

ColdFusion 2018u17, 2021u7, and 2023u1 are vulnerable to unsafe deserialization (CWE-502) of untrusted data, enabling unauthenticated remote code execution. The vulnerability requires no user interaction and can be exploited through network-accessible ColdFusion instances to achieve arbitrary code execution with server privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Adobe · ColdFusion
Related CVEs — Adobe ColdFusion

In the same product, most dangerous first.

CVE-2023-29300CRITICALAdobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionEPSS 100.0%KEVCVE-2018-15961CRITICALCVE-2018-15961EPSS 100.0%KEVCVE-2023-29298HIGHAdobe ColdFusion Improper Access Control Security feature bypassEPSS 99.8%KEVCVE-2023-38205HIGHColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298EPSS 99.8%KEVCVE-2024-20767HIGHColdFusion | Improper Access Control (CWE-284)EPSS 98.5%KEVCVE-2023-26360HIGHAdobe ColdFusion Improper Access Control Arbitrary code executionEPSS 97.3%KEV
References
https://helpx.adobe.com/security/products/coldfusion/apsb23-41.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38203