← Back

CVE-2023-38203

nvd nistnuclei
Published: Jul 20, 2023Modified: Jun 17, 2026CISA KEV

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: psirt@adobe.com (Secondary)

Description

Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

Affected (28)

Products: Adobe: Coldfusion
Adobe
1 product
Coldfusion
Configuration A
28 vulnerable
Vulnerable SoftwareAffected Versions
Adobe
Coldfusion
Version 2018
Coldfusion
Version 2018 update10
Coldfusion
Version 2018 update11
Coldfusion
Version 2018 update12
Coldfusion
Version 2018 update13
Coldfusion
Version 2018 update14
Coldfusion
Version 2018 update15
Coldfusion
Version 2018 update16
Coldfusion
Version 2018 update17
Coldfusion
Version 2018 update1
Coldfusion
Version 2018 update2
Coldfusion
Version 2018 update3
Coldfusion
Version 2018 update4
Coldfusion
Version 2018 update5
Coldfusion
Version 2018 update6
Coldfusion
Version 2018 update7
Coldfusion
Version 2018 update8
Coldfusion
Version 2018 update9
Coldfusion
Version 2021
Coldfusion
Version 2021 update1
Coldfusion
Version 2021 update2
Coldfusion
Version 2021 update3
Coldfusion
Version 2021 update4
Coldfusion
Version 2021 update5
Coldfusion
Version 2021 update6
Coldfusion
Version 2021 update7
Coldfusion
Version 2023
Coldfusion
Version 2023 update1

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (3)

Source: psirt@adobe.com
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Third Party AdvisoryUS Government Resource

Timeline

No history available yet.