Adobe · ColdFusion
CVE-2023-38205
ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298
O que é
Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
CISA: Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
O que fazer
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Prazo para as agências federais dos EUA: 10 de agosto de 2023
Mais falhas exploradas de Adobe
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 7 de jul. de 2026 | Path Traversal | ColdFusion | Crítica 10,0 | 42% |
| 24 de fev. de 2025 | Deserialization | ColdFusion | Crítica 9,8 | 91% |
| 16 de dez. de 2024 | Improper Access Control | ColdFusion | Alto 7,4 | 99% |
| 8 de jan. de 2024 | Deserialization of Untrusted Data | ColdFusion | Crítica 9,8 | >99,9% |
| 8 de jan. de 2024 | Deserialization of Untrusted Data | ColdFusion | Crítica 9,8 | 97% |
| 21 de ago. de 2023 | Deserialization of Untrusted Data | ColdFusion | Crítica 9,8 | 17% |
| 20 de jul. de 2023 | Improper Access Control | ColdFusion | Alto 7,5 | 99,8% |
| 15 de mar. de 2023 | Deserialization of Untrusted Data | ColdFusion | Alto 8,6 | 97% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.