by Kastro
Paper/Archive/CVE-2023-26359

CVE-2023-26359

Adobe ColdFusion — Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

KEV · due 11 SepEPSS 17%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 97.1.971 × 2019.4Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Affected

ProductAffectedFixed inSource
ColdFusionunspecified – CF2018U15, CF2021U5–CNA
ColdFusionunspecified – None–CNA

Scores by source

adobe (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refhelpx.adobe.com/security/products/coldfusion/apsb23-25.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26359kevcisa.gov/known-exploited-vulnerabilities-catalog