Description

Due to the vulnerability in ColdFusion's access control, an unauthenticated attacker might access the administration CFM and CFC endpoints.

Remediation

Upgrade to the latest version of Adobe ColdFusion

References

Security updates available for Adobe ColdFusion | APSB23-47

CVE-2023-29298

cve-2023-38205

Related Vulnerabilities

Apache HTTP Server URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2019-10098)

Joomla Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-18650)

Apache Tomcat Use of Incorrectly-Resolved Name or Reference Vulnerability (CVE-2021-24122)

MySQL CVE-2020-14591 Vulnerability (CVE-2020-14591)

Jenkins CVE-2013-0330 Vulnerability (CVE-2013-0330)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Known Vulnerabilities CWE-284 CVE-2023-29298 CVE-2023-38205