PT-2023-3959 · Adobe · Coldfusion

Published 2023-07-19 · Updated 2023-09-19 · CVE-2023-38206

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 2018u18 and earlier Adobe ColdFusion versions 2021u8 and earlier Adobe ColdFusion versions 2023u2 and earlier

Description The issue is related to improper access control in the ColdFusion platform, which could allow a remote attacker to bypass existing security restrictions. This vulnerability could result in a security feature bypass, enabling an attacker to access administration CFM and CFC endpoints, leading to a low-confidentiality impact. Exploitation of this issue does not require user interaction.

Recommendations For Adobe ColdFusion versions 2018u18 and earlier, update to a version later than 2018u18 to resolve the issue. For Adobe ColdFusion versions 2021u8 and earlier, update to a version later than 2021u8 to resolve the issue. For Adobe ColdFusion versions 2023u2 and earlier, update to a version later than 2023u2 to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2023-04254

CVE-2023-38206

Affected Products

Coldfusion

References · 7

• https://osv.dev/vulnerability/CVE-2023-38206 · Vendor Advisory
• https://helpx.adobe.com/security/products/coldfusion/apsb23-47.html · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/696887/?sphrase_id=45691 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-38206 · Security Note
• https://bdu.fstec.ru/vul/2023-04254 · Security Note
• https://t.me/cibsecurity/70436 · Telegram Post
• https://t.me/true_secator/4637 · Telegram Post