CVE-2023-44353: critical vulnerability in Adobe ColdFusion
ColdFusion WDDX Deserialization Gadgets
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
87Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.8epss 80%
from disclosure to weapon
Published on NVDNov 17
VulnCheck+770d
In short
Adobe ColdFusion has a critical flaw where it unsafely processes specially crafted data structures (WDDX format), allowing attackers to run arbitrary code on the server without any user action needed.
Technical detail
ColdFusion WDDX deserialization vulnerability (CWE-502) allows unauthenticated remote code execution through malicious serialized objects leveraging gadget chains in Java classpath. No user interaction required; attacker can exploit via network request to vulnerable endpoint.
Summary generated and translated by AI from the official description.
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Adobe · ColdFusionRelated CVEs — Adobe ColdFusion
In the same product, most dangerous first.
CVE-2023-29300CRITICALAdobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionEPSS 100.0%KEVCVE-2018-15961CRITICALCVE-2018-15961EPSS 100.0%KEVCVE-2023-29298HIGHAdobe ColdFusion Improper Access Control Security feature bypassEPSS 99.8%KEVCVE-2023-38205HIGHColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298EPSS 99.8%KEVCVE-2024-20767HIGHColdFusion | Improper Access Control (CWE-284)EPSS 98.5%KEVCVE-2023-26360HIGHAdobe ColdFusion Improper Access Control Arbitrary code executionEPSS 97.3%KEV