CVE-2023-29298

Timeline

Detection, updates, and resolution for this record.

1. Jul 12, 2023 · Catalog

   Detected

   Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

2. Jul 20, 2023 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Aug 10, 2023 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Jun 16, 2026 · Catalog

   Updated

   Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

Affected

• cpe adobe/coldfusion2018
• vendor Adobe ColdFusionversion unspecified

Sources

• CISA KEVCVE-2023-29298

  Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.

  cisa.gov
• CVE.orgCVE-2023-29298

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2023-29298

  30-day exploitation probability 99.8%

  first.org
• NIST NVDCVE-2023-29298

  Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administrat

  nvd.nist.gov

References

• CISA note · helpx.adobe.com
• CISA note · nvd.nist.gov
• Third Party Advisory · cisa.gov