CVE-2023-26347

Description

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

Reserved 2023-02-22 | Published 2023-11-17 | Updated 2024-10-21 | Assigner adobe

Problem types

Improper Access Control (CWE-284)

Product status

Default status
affected

Any version
affected

References

helpx.adobe.com/security/products/coldfusion/apsb23-52.html vendor-advisory

cve.org (CVE-2023-26347)

nvd.nist.gov (CVE-2023-26347)

Download JSON