CVE-2023-26347

Published: Nov 17, 2023Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: psirt@adobe.com (Secondary)

Description

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

Affected (19)

Products: Adobe: Coldfusion

Adobe

1 product

Coldfusion

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Adobe Coldfusion	Before 2021
Adobe Coldfusion	Version 2021
Adobe Coldfusion	Version 2021 update10
Adobe Coldfusion	Version 2021 update11
Adobe Coldfusion	Version 2021 update1
Adobe Coldfusion	Version 2021 update2
Adobe Coldfusion	Version 2021 update3
Adobe Coldfusion	Version 2021 update4
Adobe Coldfusion	Version 2021 update5
Adobe Coldfusion	Version 2021 update6
Adobe Coldfusion	Version 2021 update7
Adobe Coldfusion	Version 2021 update8
Adobe Coldfusion	Version 2021 update9
Adobe Coldfusion	Version 2023
Adobe Coldfusion	Version 2023 update1
Adobe Coldfusion	Version 2023 update2
Adobe Coldfusion	Version 2023 update3
Adobe Coldfusion	Version 2023 update4
Adobe Coldfusion	Version 2023 update5

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html

Source: psirt@adobe.com

Release NotesVendor Advisory

https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.