Skip to content
OpenAdvisories
Critical 2 exploited CVEs WID-SEC-2023-0653 3 CVEs

Adobe ColdFusion: Mehrere Schwachstellen

Published Mar 14, 2023 · Updated Mar 14, 2023 · de-DE

Vendor: Adobe Product: ColdFusion Product: ColdFusion 2016 < Update 6 Product: ColdFusion 2018 < Update 16 Platform: Linux Platform: Windows

Summary

EincAngreifer kann mehrere Schwachstellen in Adobe ColdFusion ausnutzen, um beliebigen Programmcode auszuführen und vertrauliche Informationen offenzulegen.

Product

ColdFusion ist ein Applikationsserver sowie Framework zur Erstellung von Web basierten Applikationen.

Vulnerabilities 3

  • Critical 9.8
    CVE-2023-26359 Exploited EPSS 17%

    Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

    Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this iss…

    Adobe ColdFusion
    KEV Aug 21, 2023
  • High 8.6
    CVE-2023-26360 Exploited Public exploit Scanner template EPSS 97%

    Adobe ColdFusion Improper Access Control Arbitrary code execution

    Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does n…

    Adobe ColdFusion
    KEV Mar 15, 2023
  • Medium 4.9
    CVE-2023-26361 EPSS 59%

    Adobe ColdFusion Directory Traversal Arbitrary file system read Vulnerability

    Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in Arbitrary file system read. Exploitatio…

    Adobe ColdFusion

Revision history

  1. #1

    Initiale Fassung

References