CVE-2023-38205highunder attackCWE-284

CVE-2023-38205: high-severity vulnerability in Adobe ColdFusion

ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298

Published · Updated

Follow this CVE+ Monitor ColdFusion

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

88Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.5epss 100%
from disclosure to weapon
Published on NVDSep 14
CISA KEVJul 20
Action required by CISAfederal deadline: 2023-08-10

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Adobe ColdFusion has a flaw that allows attackers to bypass security controls and access administrative endpoints without permission. This could let unauthorized people gain control over ColdFusion systems.

Technical detail

An improper access control vulnerability in ColdFusion 2018u18, 2021u8, and 2023u2 allows attackers to bypass security features and directly access administration CFM/CFC endpoints. The vulnerability requires no user interaction and can be exploited remotely to gain unauthorized administrative access.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Adobe · ColdFusion
Related CVEs — Adobe ColdFusion

In the same product, most dangerous first.

CVE-2023-29300CRITICALAdobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionEPSS 100.0%KEVCVE-2018-15961CRITICALCVE-2018-15961EPSS 100.0%KEVCVE-2023-29298HIGHAdobe ColdFusion Improper Access Control Security feature bypassEPSS 99.8%KEVCVE-2024-20767HIGHColdFusion | Improper Access Control (CWE-284)EPSS 98.5%KEVCVE-2023-26360HIGHAdobe ColdFusion Improper Access Control Arbitrary code executionEPSS 97.3%KEVCVE-2023-38203CRITICALAnalysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCEEPSS 97.1%KEV