Lucene search
AdobeCVE-2023-38204HistorySep 14, 2023 - 8:15 a.m.
CVE-2023-38204
2023-09-1408:15:07
CWE-502
adobe
web.nvd.nist.gov
51
adobe
coldfusion
2018u18
2021u8
2023u2
deserialization
vulnerability
arbitrary code execution
nvd
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
9.4
Confidence
High
EPSS
0.965
Percentile
99.6%
Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Affected configurations
Node
adobecoldfusionMatch2018-
ORadobecoldfusionMatch2018update1
ORadobecoldfusionMatch2018update10
ORadobecoldfusionMatch2018update11
ORadobecoldfusionMatch2018update12
ORadobecoldfusionMatch2018update13
ORadobecoldfusionMatch2018update14
ORadobecoldfusionMatch2018update15
ORadobecoldfusionMatch2018update16
ORadobecoldfusionMatch2018update18
ORadobecoldfusionMatch2018update2
ORadobecoldfusionMatch2018update3
ORadobecoldfusionMatch2018update4
ORadobecoldfusionMatch2018update5
ORadobecoldfusionMatch2018update6
ORadobecoldfusionMatch2018update7
ORadobecoldfusionMatch2018update8
ORadobecoldfusionMatch2018update9
ORadobecoldfusionMatch2021-
ORadobecoldfusionMatch2021update1
ORadobecoldfusionMatch2021update2
ORadobecoldfusionMatch2021update3
ORadobecoldfusionMatch2021update4
ORadobecoldfusionMatch2021update5
ORadobecoldfusionMatch2021update6
ORadobecoldfusionMatch2021update7
ORadobecoldfusionMatch2021update8
ORadobecoldfusionMatch2023-
ORadobecoldfusionMatch2023update1
ORadobecoldfusionMatch2023update2
| Vendor | Product | Version | CPE |
|---|---|---|---|
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update15:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update16:*:*:*:*:*:* |
| adobe | coldfusion | 2018 | cpe:2.3:a:adobe:coldfusion:2018:update18:*:*:*:*:*:* |
CNA Affected
[
{
"defaultStatus": "affected",
"product": "ColdFusion",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "cf2023U2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
]Related
cvelist
cvelist
nvd
nvd
CVE-2023-38204
2023-09-14 08:15:07
CVE-2023-38203
2023-07-20 16:15:12
prion
prion
Deserialization of untrusted data
2023-09-14 08:15:00
Deserialization of untrusted data
2023-07-20 16:15:00
thn
thn
Adobe Rolls Out New Patches for Actively Exploited ColdFusion Vulnerability
2023-07-20 03:31:00
Zero-Day Attacks Exploited Critical Vulnerability in Citrix ADC and Gateway
2023-07-19 03:21:00
nessus
nessus
Adobe ColdFusion < 2018.x < 2018u19 / 2021.x < 2021u9 / 2023.x < 2023u3 Multiple Vulnerabilities (APSB23-47)
2023-07-21 00:00:00
Adobe ColdFusion < 2018.x < 2018u18 / 2021.x < 2021u8 / 2023.x < 2023u2 Code Execution (APSB23-41)
2023-07-18 00:00:00
Adobe ColdFusion Code Execution (APSB23-25) (Direct Check)
2023-08-01 00:00:00
cisa_kev
cisa_kev
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
2024-01-08 00:00:00
impervablog
impervablog
Adobe ColdFusion vulnerabilities mitigated by Imperva
2023-07-23 01:11:40
attackerkb
attackerkb
CVE-2023-38203
2023-07-20 00:00:00
CVE-2023-29298
2023-07-12 00:00:00
nuclei
nuclei
Adobe ColdFusion - Deserialization of Untrusted Data
2024-02-26 21:30:22
hivepro
hivepro
Active Exploitation of Adobe ColdFusion Critical Vulnerabilities
2023-07-18 13:02:22
cve
cve
CVE-2023-38203
2023-07-20 16:15:12
rapid7blog
rapid7blog
Active Exploitation of Multiple Adobe ColdFusion Vulnerabilities
2023-07-17 19:48:51
trellix
trellix
The Bug Report - July 2023 Edition
2023-08-02 00:00:00
The Bug Report - July 2023 Edition
2023-08-02 00:00:00
adobe
adobe
APSB23-47 : Security update available for Adobe ColdFusion
2023-07-19 00:00:00
APSB23-41 : Security update available for Adobe ColdFusion
2023-07-14 00:00:00
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
9.4
Confidence
High
EPSS
0.965
Percentile
99.6%
Related for CVE-2023-38204