CVE-2023-29298

Adobe ColdFusion Improper Access Control Security feature bypass

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

Affected

Adobe · ColdFusion

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

99.79% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2023-07-20

Nuclei

high

Published

2023-07-12

Updated

2025-10-21

Proof-of-concept exploits (1)

• CuriousLearnerDev/ColdFusion_EXp1★ · 2024-09-03

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29298.yaml

Security advisories

• https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29298

References

• CVE Record
• NVD entry