CVE-2023-29298 is an Improper Access Control vulnerability affecting Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier), and 2023.0.0.330468 (and earlier). This flaw allows an unauthenticated attacker to bypass security features and access administrative CFM and CFC endpoints without user interaction. With a CVSS score of 7.5 (HIGH) and a FAUCET Risk Score of 100/100, this vulnerability poses a significant risk due to its network-based attack vector and high impact on confidentiality. The vulnerability is actively exploited in the wild, listed in CISA's KEV catalog, and has publicly available Nuclei templates, indicating widespread community attention and exploitability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2018CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:* | ||
2018CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:* | ||
2018CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:* | ||
2018CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:* | ||
2018CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.