PT-2023-20617 · Adobe · Coldfusion

Published 2023-11-17 · Updated 2024-01-15 · CVE-2023-26347

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 2023.5 and earlier Adobe ColdFusion versions 2021.11 and earlier

Description The issue is related to an Improper Access Control that could result in a Security feature bypass. An unauthenticated attacker could leverage this to access the administration CFM and CFC endpoints, such as "/CFIDE/administrator/" or "/CFIDE/adminapi/", without requiring user interaction.

Recommendations For Adobe ColdFusion versions 2023.5 and earlier, update to a version that addresses the issue. For Adobe ColdFusion versions 2021.11 and earlier, update to a version that addresses the issue. As a temporary workaround, consider restricting access to the administration CFM and CFC endpoints until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2023-26347

Affected Products

Coldfusion

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-26347 · Security Note
• https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26347 · Vendor Advisory
• https://twitter.com/ohhara_shiojiri/status/1747106724644057415 · Twitter Post
• https://twitter.com/uyhacked/status/1734953733136753017 · Twitter Post