Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Adobe ColdFusion ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder beliebigen Programmcode auszuführen.
Product
ColdFusion ist ein Applikationsserver sowie Framework zur Erstellung von Web basierten Applikationen.
Vulnerabilities 3
-
Critical 9.8
Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not requir…
KEV Jan 8, 2024 -
High 7.5
Adobe ColdFusion Improper Access Control Security feature bypass
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to a…
KEV Jul 20, 2023 -
High 7.5CVE-2023-29301 EPSS 35%
Adobe ColdFusion Improper Restriction of Excessive Authentication Attempts Security feature bypass
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a Security feature bypass. An attacker coul…
Revision history
-
#2
Exploit hinzugefügt.
-
#1
Initiale Fassung
References
-
Exploit für CVE-2023-29298 vom 2023-07-18
https://www.rapid7.com/blog/post/2023/07/17/etr-active-exploitation-of-multiple-adobe-coldfusion-vulnerabilities/
-
Adobe Security Bulletin APSB23-40 vom 2023-07-11
https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html