CVE-2023-38203
Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE
At a glance Severity CRITICAL 9.8 Exploitation Known exploited (CISA KEV) · added 2024-01-08 Exploited per ENISA since 2024-01-08 EPSS EPSS 97.07 % · percentile 100 (2026-10-27) State PUBLISHED Published 2023-07-20 Updated 2025-10-21 Assigner adobe NVD status Analyzed Description Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Scores Version Score Vector Scored by CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H adobe CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · psirt@adobe.com (Secondary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update15:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update16:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update17:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*Affected products
References
Sources
