CVE-2023-26360

🗓️ 23 Mar 2023 00:00:00Reported by adobeType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 1084 Views🌐 WEB

Adobe ColdFusion versions 2018 Update 15 and 2021 Update 5 are affected by Improper Access Control vulnerability

Reporter	Title	Published	Views	Family All 52
zdt	Adobe ColdFusion Unauthenticated Remote Code Execution Exploit	2 May 202300:00	–	zdt
zdt	Adobe ColdFusion v 2018,15 (and earlier) and 2021,5 and earlier - Arbitrary File Read Exploit	11 Mar 202400:00	–	zdt
GithubExploit	Exploit for Improper Access Control in Adobe Coldfusion	28 Oct 202504:10	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Adobe Coldfusion	16 May 202619:00	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Adobe Coldfusion	25 Nov 202417:42	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Adobe Coldfusion	14 May 202411:22	–	githubexploit
ICS	Threat Actors Exploit Adobe ColdFusion CVE-2023-26360 for Initial Access to Government Servers	5 Dec 202312:00	–	ics
Tenable Nessus	Adobe ColdFusion Code Execution (APSB23-25) (Direct Check)	1 Aug 202300:00	–	nessus
Tenable Nessus	Adobe ColdFusion < 2018.x < 2018 Update 16 / 2021.x < 2021 Update 6 Multiple Vulnerabilities (APSB23-25)	16 Mar 202300:00	–	nessus
Tenable Nessus	Adobe ColdFusion ComponentFilter Remote Code Execution	31 May 202300:00	–	nessus

NVD

Node

adobe coldfusionMatch2018-

adobe coldfusionMatch2018update1

adobe coldfusionMatch2018update10

adobe coldfusionMatch2018update11

adobe coldfusionMatch2018update12

adobe coldfusionMatch2018update13

adobe coldfusionMatch2018update14

adobe coldfusionMatch2018update15

adobe coldfusionMatch2018update2

adobe coldfusionMatch2018update3

adobe coldfusionMatch2018update4

adobe coldfusionMatch2018update5

adobe coldfusionMatch2018update6

adobe coldfusionMatch2018update7

adobe coldfusionMatch2018update8

adobe coldfusionMatch2018update9

adobe coldfusionMatch2021-

adobe coldfusionMatch2021update1

adobe coldfusionMatch2021update2

adobe coldfusionMatch2021update3

adobe coldfusionMatch2021update4

adobe coldfusionMatch2021update5

[
  {
    "vendor": "Adobe",
    "product": "ColdFusion",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "CF2018U15",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThanOrEqual": "CF2021U5",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThanOrEqual": "None",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
helpx	www.helpx.adobe.com/security/products/coldfusion/apsb23-25.html
packetstormsecurity	www.packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
method	request body	/CFIDE/wizards/common/utils.cfc	Unauthenticated arbitrary file read via ColdFusion CFC endpoint using deserialization (CVE-2023-26360).	CWE-284
_cfclient	request body	/CFIDE/wizards/common/utils.cfc	Unauthenticated arbitrary file read via ColdFusion CFC endpoint using deserialization (CVE-2023-26360).	CWE-284
returnFormat	request body	/CFIDE/wizards/common/utils.cfc	Unauthenticated arbitrary file read via ColdFusion CFC endpoint using deserialization (CVE-2023-26360).	CWE-284
_variables	request body	/CFIDE/wizards/common/utils.cfc	Unauthenticated arbitrary file read via ColdFusion CFC endpoint using deserialization (CVE-2023-26360).	CWE-284