Improper access control in ColdFusion - CVE-2023-26360
Published: March 14, 2023 / Updated: October 25, 2024
Vulnerability identifier: #VU73597
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-26360
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.
Note, the vulnerability is being actively exploited in the wild.
Affected software
ColdFusion
How to mitigate CVE-2023-26360
Install updates from vendor's website.
ColdFusion - addressed in versions 2018 Update 16, 2021 Update 6
Links to Public Exploits and PoC-codes
- Exploit #10721 - Adobe ColdFusion versions 2018_15 (and earlier) and 2021_5 and earlier - Arbitrary File Read (October 25, 2024)
- Exploit #9930 - CVE-2023-26360-adobe-coldfusion-rce-exploit () (June 7, 2024)
- Exploit #9017 - Adobe ColdFusion Unauthenticated Remote Code Execution (April 28, 2023)
- Exploit #9018 - Adobe ColdFusion Unauthenticated Arbitrary File Read (April 28, 2023)