{"id":25288,"date":"2023-07-13T22:02:00","date_gmt":"2023-07-13T22:02:00","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=25288"},"modified":"2026-04-17T18:07:40","modified_gmt":"2026-04-17T18:07:40","slug":"adobe-coldfusion-multiple-security-vulnerabilities-notification-2","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/adobe-coldfusion-multiple-security-vulnerabilities-notification-2\/","title":{"rendered":"Adobe ColdFusion Multiple Security Vulnerabilities Notification"},"content":{"rendered":"\n

Overview<\/h2>\n\n\n\n

Recently, NSFOCUS CERT monitored that Adobe has officially released security notices and fixed multiple Adobe ColdFusion vulnerabilities. Affected users should take measures as soon as possible. The key vulnerabilities are as follows:<\/p>\n\n\n\n

Adobe ColdFusion<\/strong> Access Control Bypass Vulnerability (CVS 2023-29298):<\/strong><\/p>\n\n\n\n

Adobe ColdFusion has an access control bypass vulnerability that allows attackers to access management endpoints by inserting unexpected additional forward slash characters in the requested URL. Unauthenticated remote attackers can exploit this vulnerability to execute arbitrary code on the target system. At present, the details of the vulnerability have been disclosed on the internet, with a CVSS score of 7.5.<\/p>\n\n\n\n

Adobe ColdFusion<\/strong> Deserialization Vulnerability (CVS 2023-29300):<\/strong><\/p>\n\n\n\n

Due to a flaw in Adobe ColdFusion’s deserialization security check, unauthenticated remote attackers can carry out deserialization attacks by constructing malicious data packets, ultimately enabling the execution of arbitrary code on the target system, with a CVSS score of 9.8.<\/p>\n\n\n\n

Reference link: https:\/\/helpx.adobe.com\/security\/products\/coldfusion\/apsb23-40.html<\/a><\/p>\n\n\n\n

Scope of Impact<\/h2>\n\n\n\n

Affected<\/strong> version:<\/strong><\/p>\n\n\n\n