Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Advisory: Adobe ColdFusion — helpx.adobe.com/security/products/coldfusion/apsb23-52.html Clear all filters
TI-2023-23867 CVE-2023-44351 · GHSA-c646-q547-q9p8

Adobe ColdFusion RCE Security Vulnerability

Priority HIGH 80

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.5016 Published 2023-11-17 No fix listed CWE-502
TI-2023-23870 CVE-2023-44355 · GHSA-qh5q-fw44-7cp6

ColdFusion | Improper Input Validation (CWE-20)

Priority MEDIUM 53

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.47169 Published 2023-11-17 No fix listed CWE-20
TI-2023-11500 CVE-2023-26347 · GHSA-j425-965m-rmg6

CVE-2023-38205 issues | ColdFusion Admin Panel Access

Priority MEDIUM 51

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.10072 Published 2023-11-17 No fix listed CWE-284
TI-2023-23869 CVE-2023-44353 · GHSA-g46m-g2gp-9x28

ColdFusion WDDX Deserialization Gadgets

Priority CRITICAL 89

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.80178 Published 2023-11-17 No fix listed CWE-502
TI-2023-23866 CVE-2023-44350 · GHSA-65r5-5h5r-23qc

ColdFusion | Deserialization of Untrusted Data (CWE-502)

Priority CRITICAL 85

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.64558 Published 2023-11-17 No fix listed CWE-502