Actively exploited · Published Sep 14, 2023 · Assigned by adobe
CVE-2023-38205ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298
High 7.5 Exploited
In plain English
A high-severity improper access control in ColdFusion from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on July 20, 2023). The chance it is exploited in the next 30 days is estimated at 99.8% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Aug 10, 2023.
Official description
Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | ColdFusion | 0 – through cf2023U2 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N