A vulnerability was found in Adobe ColdFusion up to 2023.0.0.330468 (Programming Language Software). It has been rated as critical. This issue affects an unknown function. The manipulation with an unknown input leads to a deserialization vulnerability. Using CWE to declare the problem leads to CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

The weakness was released 07/12/2023 as apsb23-40. It is possible to read the advisory at helpx.adobe.com. The identification of this vulnerability is CVE-2023-29300 since 04/04/2023. Technical details are unknown but an exploit is available.

It is declared as highly functional. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 01/08/2024 with a due date of 01/29/2024:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Upgrading eliminates this vulnerability.

Productinfo

Type

• Programming Language Software

Vendor

• Adobe

Name

• ColdFusion

Version

• 2023.0.0.330468

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion