Published: 23/03/2023 Updated: 01/05/2023

CVSS v3 Base Score: 8.6 | Impact Score: 4 | Exploitability Score: 3.9

VMScore: 0

Adobe ColdFusion versions 2018 Update 15 (and previous versions) and 2021 Update 5 (and previous versions) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Vulnerable Product	Search on Vulmon	Subscribe to Product
adobe coldfusion 2018
adobe coldfusion 2021

Check Point Reference: CPAI-2023-0313 Date Published: 14 May 2023 Severity: Critical ...

This Metasploit module exploits a remote unauthenticated deserialization of untrusted data vulnerability in Adobe ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier, in order to gain remote code execution ...

Adobe ColdFusion versions 2018,15 and below and versions 2021,5 and below suffer from an arbitrary file read vulnerability ...

This module exploits a remote unauthenticated deserialization of untrusted data vulnerability in Adobe ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier, in order to gain remote code execution ...

This module exploits a remote unauthenticated deserialization of untrusted data vulnerability in Adobe ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier, in order to read an arbitrary file from the server To run this module you must provide a valid ColdFusion Component (CFC) endpoi ...

This module exploits a remote unauthenticated deserialization of untrusted data vulnerability in Adobe ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier, in order to gain remote code execution.

msf > use exploit/multi/http/adobe_coldfusion_rce_cve_2023_26360
msf exploit(adobe_coldfusion_rce_cve_2023_26360) > show targets
    ...targets...
msf exploit(adobe_coldfusion_rce_cve_2023_26360) > set TARGET < target-id >
msf exploit(adobe_coldfusion_rce_cve_2023_26360) > show options
    ...show and set options...
msf exploit(adobe_coldfusion_rce_cve_2023_26360) > exploit

This module exploits a remote unauthenticated deserialization of untrusted data vulnerability in Adobe ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier, in order to read an arbitrary file from the server. To run this module you must provide a valid ColdFusion Component (CFC) endpoint via the CFC_ENDPOINT option, and a valid remote method name from that endpoint via the CFC_METHOD option. By default an endpoint in the ColdFusion Administrator (CFIDE) is provided. If the CFIDE is not accessible you will need to choose a different CFC endpoint, method and parameters.

msf > use auxiliary/gather/adobe_coldfusion_fileread_cve_2023_26360
msf auxiliary(adobe_coldfusion_fileread_cve_2023_26360) > show actions
    ...actions...
msf auxiliary(adobe_coldfusion_fileread_cve_2023_26360) > set ACTION < action-name >
msf auxiliary(adobe_coldfusion_fileread_cve_2023_26360) > show options
    ...show and set options...
msf auxiliary(adobe_coldfusion_fileread_cve_2023_26360) > run

Exploit for Arbitrary File Read for CVE-2023-26360 - Adobe Coldfusion

CVE-2023-26360

CVE-2023-26360-adobe-coldfusion-rce-exploit

CISA details twin attacks on federal servers via unpatched ColdFusion flaw

The Register

Topics Security Off-Prem On-Prem Software Offbeat Special Features Vendor Voice Vendor Voice Resources Tardy IT admins likely to get a chilly reception over the lack of updates

CISA has released details about a federal agency that recently had at least two public-facing servers compromised by attackers exploiting a critical Adobe ColdFusion vulnerability. The vulnerability, tracked as CVE-2023-26360, was disclosed in March and was shortly after added to CISA's known exploited vulnerability (KEV) catalog, setting an April 5 deadline for agencies to fix the issue. In a Tuesday advisory, CISA revealed the federal civilian executive branch (FCEB) in question was successful...

CVE-2023-26360

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Metasploit Modules

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect