CVE-2023-29298

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
adobeCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
adobecoldfusion
𝑥
≤ 2023.0.0.330468
CNA
Common Weakness Enumeration
References
https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html
https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29298