CVE-2023-38205

CVE-2023-38205 is a high-severity (CVSS 7.5) vulnerability in Adobe ColdFusion. CISA added it to the Known Exploited Vulnerabilities catalog on July 20, 2023, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by August 10, 2023. CISA does not currently list it as used in ransomware campaigns. Adobe has 83 vulnerabilities in the KEV catalog, 11 of them linked to ransomware.

Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• https://helpx.adobe.com/security/products/coldfusion/apsb23-47.html
• https://helpx.adobe.com/security/products/coldfusion/apsb23-47.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38205