← Back

CVE-2023-26359

nvd nist
Published: Mar 23, 2023Modified: Jun 17, 2026CISA KEV

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: psirt@adobe.com (Secondary)

Description

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Affected (22)

Products: Adobe: Coldfusion
Adobe
1 product
Coldfusion
Configuration A
22 vulnerable
Vulnerable SoftwareAffected Versions
Adobe
Coldfusion
Version 2018
Coldfusion
Version 2018 update10
Coldfusion
Version 2018 update11
Coldfusion
Version 2018 update12
Coldfusion
Version 2018 update13
Coldfusion
Version 2018 update14
Coldfusion
Version 2018 update15
Coldfusion
Version 2018 update1
Coldfusion
Version 2018 update2
Coldfusion
Version 2018 update3
Coldfusion
Version 2018 update4
Coldfusion
Version 2018 update5
Coldfusion
Version 2018 update6
Coldfusion
Version 2018 update7
Coldfusion
Version 2018 update8
Coldfusion
Version 2018 update9
Coldfusion
Version 2021
Coldfusion
Version 2021 update1
Coldfusion
Version 2021 update2
Coldfusion
Version 2021 update3
Coldfusion
Version 2021 update4
Coldfusion
Version 2021 update5

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (3)

Source: psirt@adobe.com
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Third Party AdvisoryUS Government Resource

Timeline

No history available yet.