Skip to content
OpenAdvisories
High 1 exploited CVE WID-SEC-2023-1838 3 CVEs

Adobe ColdFusion: Mehrere Schwachstellen

Published Jul 19, 2023 · Updated Jul 19, 2023 · de-DE

Vendor: Adobe Product: ColdFusion Product: ColdFusion < 2018 Update 19 Product: ColdFusion < 2021 Update 9 Product: ColdFusion < 2023 Update 3 Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Adobe ColdFusion ausnutzen, um beliebigen Programmcode auszuführen oder Sicherheitsvorkehrungen zu umgehen.

Product

ColdFusion ist ein Applikationsserver sowie Framework zur Erstellung von Web basierten Applikationen.

Vulnerabilities 3

  • High 7.5
    CVE-2023-38205 Exploited Scanner template EPSS 100%

    ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298

    Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the…

    Adobe ColdFusion
    KEV Jul 20, 2023
  • Critical 9.8
    CVE-2023-38204 EPSS 70%

    Bypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8

    Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user in…

    Adobe ColdFusion
  • Medium 5.3
    CVE-2023-38206

    ColdFusion | Improper Access Control (CWE-284)

    Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the…

    Adobe ColdFusion

Revision history

  1. #1

    Initiale Fassung

References