CVE-2023-38205

HIGHCISA KEV

7.5

Description

Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

Details CVE

Score CVSS v3.17.5

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie9/14/2023

Derniere modification10/23/2025

Sourcekev

Observations honeypot0

CISA KEV

FournisseurAdobe

ProduitColdFusion

Nom vulnerabiliteAdobe ColdFusion Improper Access Control Vulnerability

Date ajout KEV2023-07-20

Date limite remediation2023-08-10

Utilise dans ransomwareUnknown

Produits affectes

adobe:coldfusion

Faiblesses (CWE)

CWE-284

References

https://helpx.adobe.com/security/products/coldfusion/apsb23-47.html(psirt@adobe.com)

https://helpx.adobe.com/security/products/coldfusion/apsb23-47.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38205(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.