PT-2023-3963 · Adobe · Coldfusion

Published 2023-07-11 · Updated 2023-08-30 · CVE-2023-29301

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 2018u16 and earlier Adobe ColdFusion versions 2021u6 and earlier Adobe ColdFusion versions 2023.0.0.330468 and earlier

Description The issue is related to insufficient restriction of excessive authentication attempts, allowing a remote attacker to bypass existing security restrictions using a brute force attack. This could result in a security feature bypass, potentially impacting user confidentiality. Exploitation of this issue does not require user interaction.

Recommendations For Adobe ColdFusion versions 2018u16 and earlier, update to a version later than 2018u16 to resolve the issue. For Adobe ColdFusion versions 2021u6 and earlier, update to a version later than 2021u6 to resolve the issue. For Adobe ColdFusion versions 2023.0.0.330468 and earlier, update to a version later than 2023.0.0.330468 to resolve the issue. As a temporary workaround, consider restricting access to the CFAdmin authentication component to minimize the risk of exploitation.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

BDU:2023-04258

CVE-2023-29301

Affected Products

Coldfusion

References · 7

• https://bdu.fstec.ru/vul/2023-04258 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29301 · Vendor Advisory
• https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29301 · Security Note
• https://cybersecurity-help.cz/vdb/SB2023071180 · Note
• https://twitter.com/hoyahaxa/status/1696873909113532537 · Twitter Post
• https://t.me/cvenotify/54742 · Telegram Post