Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveAdobeCVE-2023-26347
HistoryNov 17, 2023 - 2:15 p.m.

CVE-2023-26347

2023-11-1714:15:20
CWE-284
adobe
web.nvd.nist.gov
56
adobe
coldfusion
cve-2023-26347
security
access control
vulnerability
administration
exploitation

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.949

Percentile

99.3%

JSON

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

Affected configurations

Nvd
Vulners
Node
adobecoldfusionRange<2021
OR
adobecoldfusionMatch2021-
OR
adobecoldfusionMatch2021update1
OR
adobecoldfusionMatch2021update10
OR
adobecoldfusionMatch2021update11
OR
adobecoldfusionMatch2021update2
OR
adobecoldfusionMatch2021update3
OR
adobecoldfusionMatch2021update4
OR
adobecoldfusionMatch2021update5
OR
adobecoldfusionMatch2021update6
OR
adobecoldfusionMatch2021update7
OR
adobecoldfusionMatch2021update8
OR
adobecoldfusionMatch2021update9
OR
adobecoldfusionMatch2023-
OR
adobecoldfusionMatch2023update1
OR
adobecoldfusionMatch2023update2
OR
adobecoldfusionMatch2023update3
OR
adobecoldfusionMatch2023update4
OR
adobecoldfusionMatch2023update5
VendorProductVersionCPE
adobecoldfusion*cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*
adobecoldfusion2021cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*
adobecoldfusion2021cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*
adobecoldfusion2021cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:*
adobecoldfusion2021cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:*
adobecoldfusion2021cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*
adobecoldfusion2021cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*
adobecoldfusion2021cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*
adobecoldfusion2021cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*
adobecoldfusion2021cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*
Rows per page:
1-10 of 191

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "ColdFusion",
    "vendor": "Adobe",
    "versions": [
      {
        "lessThanOrEqual": "2021.11",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Related

cvelist 2
hackerone 3
nvd 2
prion 2
cnvd 1
nuclei 2
adobe 2
cisa_kev 1
nessus 2
attackerkb 1
cve 1
rapid7blog 2
vulnrichment 1
impervablog 1
thn 1
cvelist
cvelist
CVE-2023-26347 CVE-2023-38205 issues | ColdFusion Admin Panel Access
2023-11-17 13:31:33
CVE-2023-38205 ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298
2023-09-14 07:40:12
hackerone
hackerone
U.S. Dept Of Defense: CVE-2023-26347 in https://████.mil/hax/..CFIDE/adminapi/administrator.cfc?method=getBuildNumber&_cfclient=true
2024-05-24 13:41:36
U.S. Dept Of Defense: Adobe ColdFusion - Access Control Bypass [CVE-2023-38205] at ██████
2023-07-24 18:24:11
U.S. Dept Of Defense: Adobe ColdFusion Access Control Bypass - CVE-2023-38205
2023-07-31 09:52:10
nvd
nvd
CVE-2023-26347
2023-11-17 14:15:20
CVE-2023-38205
2023-09-14 08:15:07
prion
prion
Improper access control
2023-11-17 14:15:00
Improper access control
2023-09-14 08:15:00
cnvd
cnvd
Adobe ColdFusion Access Control Error Vulnerability
2023-11-21 00:00:00
nuclei
nuclei
Adobe Coldfusion - Authentication Bypass
2023-11-23 11:53:05
Adobe ColdFusion - Access Control Bypass
2023-07-19 21:25:31
adobe
adobe
APSB23-52 : Security update available for Adobe ColdFusion
2023-11-14 00:00:00
APSB23-47 : Security update available for Adobe ColdFusion
2023-07-19 00:00:00
cisa_kev
cisa_kev
Adobe ColdFusion Improper Access Control Vulnerability
2023-07-20 00:00:00
nessus
nessus
Adobe ColdFusion < 2021.x < 2021u12 / 2023.x < 2023u6 Multiple Vulnerabilities (APSB23-52)
2023-11-15 00:00:00
Adobe ColdFusion < 2018.x < 2018u19 / 2021.x < 2021u9 / 2023.x < 2023u3 Multiple Vulnerabilities (APSB23-47)
2023-07-21 00:00:00
attackerkb
attackerkb
CVE-2023-38205
2023-09-14 00:00:00
cve
cve
CVE-2023-38205
2023-09-14 08:15:07
rapid7blog
rapid7blog
CVE-2023-38205: Adobe ColdFusion Access Control Bypass [FIXED]
2023-07-19 17:25:06
Active Exploitation of Multiple Adobe ColdFusion Vulnerabilities
2023-07-17 19:48:51
vulnrichment
vulnrichment
CVE-2023-38205 ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298
2023-09-14 07:40:12
impervablog
impervablog
Adobe ColdFusion vulnerabilities mitigated by Imperva
2023-07-23 01:11:40
thn
thn
Adobe Rolls Out New Patches for Actively Exploited ColdFusion Vulnerability
2023-07-20 03:31:00

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.949

Percentile

99.3%

JSON
Related for CVE-2023-26347
cvelist2hackerone3nvd2prion2cnvd1nuclei2adobe2cisa_kev1nessus2attackerkb1cve1rapid7blog2vulnrichment1impervablog1thn1