Actively exploited · Published Jul 12, 2023 · Assigned by adobe
CVE-2023-29298Adobe ColdFusion Improper Access Control Security feature bypass
High 7.5 Exploited
In plain English
A high-severity improper access control in ColdFusion from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on July 20, 2023). The chance it is exploited in the next 30 days is estimated at 99.8% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Aug 10, 2023.
Official description
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | ColdFusion | 0 – through 2023.0.0.330468 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N