Adobe · ColdFusion
CVE-2023-38205
ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298
What it is
Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
CISA: Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: August 10, 2023
More exploited flaws from Adobe
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jul 7, 2026 | Path Traversal | ColdFusion | Critical 10.0 | 42% |
| Feb 24, 2025 | Deserialization | ColdFusion | Critical 9.8 | 91% |
| Dec 16, 2024 | Improper Access Control | ColdFusion | High 7.4 | 99% |
| Jan 8, 2024 | Deserialization of Untrusted Data | ColdFusion | Critical 9.8 | >99.9% |
| Jan 8, 2024 | Deserialization of Untrusted Data | ColdFusion | Critical 9.8 | 97% |
| Aug 21, 2023 | Deserialization of Untrusted Data | ColdFusion | Critical 9.8 | 17% |
| Jul 20, 2023 | Improper Access Control | ColdFusion | High 7.5 | 99.8% |
| Mar 15, 2023 | Deserialization of Untrusted Data | ColdFusion | High 8.6 | 97% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.