PT-2023-3967 · Adobe · Coldfusion

CVE-2023-29300

·

Published

2023-07-11

·

Updated

2026-07-01

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions prior to 2018u17 Adobe ColdFusion versions prior to 2021u7 Adobe ColdFusion versions prior to 2023.0.0.330469
Description Adobe ColdFusion is affected by a deserialization of untrusted data issue. This pre-authentication flaw allows a remote attacker to execute arbitrary code on the system without requiring any user interaction. The technical exploitation involves the parsing of WDDX packets and escalating a JNDI injection to achieve Remote Code Execution (RCE). Deserialization is the process of converting a data format, such as JSON or XML, back into an object in memory.
Recommendations Update Adobe ColdFusion 2018 to a version later than 2018u16. Update Adobe ColdFusion 2021 to a version later than 2021u6. Update Adobe ColdFusion 2023 to a version later than 2023.0.0.330468.

Fix

Deserialization of Untrusted Data

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-04263
CVE-2023-29300

Affected Products

Coldfusion