CVE-2023-44350

Published: Nov 17, 2023Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: psirt@adobe.com (Secondary)

Description

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

Affected (19)

Products: Adobe: Coldfusion

Adobe

1 product

Coldfusion

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Adobe Coldfusion	Before 2021
Adobe Coldfusion	Version 2021
Adobe Coldfusion	Version 2021 update10
Adobe Coldfusion	Version 2021 update11
Adobe Coldfusion	Version 2021 update1
Adobe Coldfusion	Version 2021 update2
Adobe Coldfusion	Version 2021 update3
Adobe Coldfusion	Version 2021 update4
Adobe Coldfusion	Version 2021 update5
Adobe Coldfusion	Version 2021 update6
Adobe Coldfusion	Version 2021 update7
Adobe Coldfusion	Version 2021 update8
Adobe Coldfusion	Version 2021 update9
Adobe Coldfusion	Version 2023
Adobe Coldfusion	Version 2023 update1
Adobe Coldfusion	Version 2023 update2
Adobe Coldfusion	Version 2023 update3
Adobe Coldfusion	Version 2023 update4
Adobe Coldfusion	Version 2023 update5

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html

Source: psirt@adobe.com

Release NotesVendor Advisory

https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.