Evil-DB LogoEvil-DB
← All CVEs

CVE-2023-29298

high · 7.5Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Added 2023-07-20Remediation due 2023-08-10

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

7.5
CVSS
99.8%
EPSS (exploit prob.)
100th
EPSS percentile
2023-07-12
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-284

Affected products

VendorProductAffected versions
adobecoldfusion2018
adobecoldfusion2018
adobecoldfusion2018
adobecoldfusion2018
adobecoldfusion2018
adobecoldfusion2018
adobecoldfusion2018
adobecoldfusion2018
adobecoldfusion2018
adobecoldfusion2018
adobecoldfusion2018
adobecoldfusion2018
adobecoldfusion2018
adobecoldfusion2018
adobecoldfusion2018
adobecoldfusion2018
adobecoldfusion2018
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2023

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-29298