Adobe ColdFusion Vulnerability Could Lead to Arbitrary Code Execution
CVE-2023-29300

9.8CRITICAL

Key Information:

Vendor
Adobe
Status
ColdFusion
Vendor
CVE Published:
12 July 2023

Badges

📈 Score: 170💰 Ransomware👾 Exploit Exists🟣 EPSS 39%🦅 CISA Reported📰 News Worthy

Summary

Adobe ColdFusion is significantly impacted by a vulnerability that arises from the deserialization of untrusted data. This issue allows for the potential execution of arbitrary code by an attacker, posing serious risks to system integrity and security. Notably, exploitation does not require any user interaction, thereby amplifying the threat potential. Affected versions include ColdFusion 2018u16 and earlier, 2021u6 and earlier, and 2023.0.0.330468 and earlier. Organizations using these versions are urged to evaluate their security posture and apply necessary updates to mitigate risks.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

ColdFusion 0 <= 2023.0.0.330468

News Articles

favicon imageGBHackers on Security

Hackers Actively Exploit Multiple Adobe ColdFusion Vulnerabilities

The CVE-2023-29300 patch blocks specific class deserialization in ColdFusion's WDDX data, preventing gadget-based attacks without breaking existing dependencies.

1 year ago

favicon imageTechTarget

Multiple Adobe ColdFusion flaws exploited in the wild | TechTarget

Multiple flaws in popular application server Adobe ColdFusion were exploited in the wild, including a zero-day that a vendor inadvertently published.

1 year ago

favicon imageBleepingComputer

Critical ColdFusion flaws exploited in attacks to drop webshells

Hackers are actively exploiting two ColdFusion vulnerabilities to bypass authentication and remotely execute commands to install webshells on vulnerable servers.

1 year ago

References

https://helpx.adobe.com/security/products/coldfusion/apsb...
vendor-advisory

EPSS Score

39% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 💰

    Used in Ransomware

  • 🦅

    CISA Reported

  • Vulnerability published

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by SecurityWeek

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre DatabaseCISA Database4 News Article(s)
.