CVE-2023-38203

CVE-2023-38203 is a critical-severity (CVSS 9.8) vulnerability in Adobe ColdFusion. CISA added it to the Known Exploited Vulnerabilities catalog on January 8, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by January 29, 2024. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Adobe has 83 vulnerabilities in the KEV catalog, 11 of them linked to ransomware.

Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• https://helpx.adobe.com/security/products/coldfusion/apsb23-41.html
• https://helpx.adobe.com/security/products/coldfusion/apsb23-41.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38203