Lucene search
AdobeCVE-2023-38205HistorySep 14, 2023 - 8:15 a.m.
CVE-2023-38205
2023-09-1408:15:07
CWE-284
adobe
web.nvd.nist.gov
1661
In Wild
adobe
coldfusion
cve-2023-38205
improper access control
security feature bypass
administration endpoints
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
7.3
Confidence
High
EPSS
0.969
Percentile
99.8%
Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
Affected configurations
Node
adobecoldfusionMatch2018-
ORadobecoldfusionMatch2018update1
ORadobecoldfusionMatch2018update10
ORadobecoldfusionMatch2018update11
ORadobecoldfusionMatch2018update12
ORadobecoldfusionMatch2018update13
ORadobecoldfusionMatch2018update14
ORadobecoldfusionMatch2018update15
ORadobecoldfusionMatch2018update16
ORadobecoldfusionMatch2018update18
ORadobecoldfusionMatch2018update2
ORadobecoldfusionMatch2018update3
ORadobecoldfusionMatch2018update4
ORadobecoldfusionMatch2018update5
ORadobecoldfusionMatch2018update6
ORadobecoldfusionMatch2018update7
ORadobecoldfusionMatch2018update8
ORadobecoldfusionMatch2018update9
ORadobecoldfusionMatch2021-
ORadobecoldfusionMatch2021update1
ORadobecoldfusionMatch2021update2
ORadobecoldfusionMatch2021update3
ORadobecoldfusionMatch2021update4
ORadobecoldfusionMatch2021update5
ORadobecoldfusionMatch2021update6
ORadobecoldfusionMatch2021update7
ORadobecoldfusionMatch2021update8
ORadobecoldfusionMatch2023-
ORadobecoldfusionMatch2023update1
ORadobecoldfusionMatch2023update2
| Vendor | Product | Version | CPE |
|---|---|---|---|
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update15:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update16:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update18:*:*:*:*:*:* |
CNA Affected
[
{
"defaultStatus": "affected",
"product": "ColdFusion",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "cf2023U2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
]Related
attackerkb
attackerkb
CVE-2023-38205
2023-09-14 00:00:00
CVE-2023-29298
2023-07-12 00:00:00
rapid7blog
rapid7blog
CVE-2023-38205: Adobe ColdFusion Access Control Bypass [FIXED]
2023-07-19 17:25:06
Active Exploitation of Multiple Adobe ColdFusion Vulnerabilities
2023-07-17 19:48:51
CVE-2023-29298: Adobe ColdFusion Access Control Bypass
2023-07-11 15:30:00
hackerone
hackerone
cvelist
cvelist
vulnrichment
vulnrichment
nvd
nvd
CVE-2023-38205
2023-09-14 08:15:07
CVE-2023-29298
2023-07-12 16:15:11
prion
prion
Improper access control
2023-09-14 08:15:00
Improper access control
2023-07-12 16:15:00
cisa_kev
cisa_kev
Adobe ColdFusion Improper Access Control Vulnerability
2023-07-20 00:00:00
Adobe ColdFusion Improper Access Control Vulnerability
2023-07-20 00:00:00
nuclei
nuclei
Adobe ColdFusion - Access Control Bypass
2023-07-19 21:25:31
Adobe ColdFusion - Access Control Bypass
2023-07-12 22:08:33
impervablog
impervablog
Adobe ColdFusion vulnerabilities mitigated by Imperva
2023-07-23 01:11:40
cve
cve
CVE-2023-26347
2023-11-17 14:15:20
CVE-2023-29298
2023-07-12 16:15:11
thn
thn
Adobe Rolls Out New Patches for Actively Exploited ColdFusion Vulnerability
2023-07-20 03:31:00
Zero-Day Attacks Exploited Critical Vulnerability in Citrix ADC and Gateway
2023-07-19 03:21:00
nessus
nessus
cnvd
cnvd
Adobe Coldfusion Access Control Bypass Vulnerability
2023-07-13 00:00:00
githubexploit
githubexploit
Exploit for Improper Access Control in Adobe Coldfusion
2024-09-03 09:53:57
hivepro
hivepro
Active Exploitation of Adobe ColdFusion Critical Vulnerabilities
2023-07-18 13:02:22
adobe
adobe
APSB23-40 : Security update available for Adobe ColdFusion
2023-07-11 00:00:00
APSB23-47 : Security update available for Adobe ColdFusion
2023-07-19 00:00:00
trellix
trellix
The Bug Report - July 2023 Edition
2023-08-02 00:00:00
The Bug Report - July 2023 Edition
2023-08-02 00:00:00
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
7.3
Confidence
High
EPSS
0.969
Percentile
99.8%
Related for CVE-2023-38205