Description

Due to a vulnerability in ColdFusion components(.cfc) metadata handling, an unauthenticated attacker can execute arbitrary code or read files on the server

Remediation

Upgrade to the latest version of Adobe ColdFusion

References

Security updates available for Adobe ColdFusion | APSB23-25

CVE-2023-26359

Related Vulnerabilities

Drupal URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2016-9451)

phpMyAdmin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-2043)

WordPress Cross-Site Scripting Vulnerability (3.0 - 3.6.1)

WebLogic CVE-2018-3249 Vulnerability (CVE-2018-3249)

WordPress Plugin Microblog Poster SQL Injection (1.6.0)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Insecure Deserialization Code Execution Known Vulnerabilities Missing Update CWE-502 CVE-2023-26359 CVE-2023-26360