CVE-2023-29298

CVE-2023-29298 is an improper access control flaw (CWE-284) in Adobe ColdFusion that lets a remote, unauthenticated attacker reach ColdFusion's administrative CFM and CFC endpoints, bypassing the access controls meant to protect them. It is triggered directly over the network with no user interaction and no privileges required (CVSS 3.1: 7.5, high confidentiality impact). An attacker gains access to administrative endpoints as a security feature bypass; in practice, Adobe patched this flaw in the same July 2023 out-of-band update as a critical, actively exploited ColdFusion RCE, and it can be used to reach the server's admin surface. All Adobe ColdFusion deployments running 2018 Update 16 (and earlier), 2021 Update 6 (and earlier), or 2023.0.0.330468 (and earlier) are affected. Exploitation is confirmed in the wild: CISA added it to the KEV on 2023-07-20 and EPSS assigns a 99.8% probability of exploitation within 30 days.

What to do: Apply Adobe's July 2023 out-of-band ColdFusion updates immediately - upgrade beyond the affected builds (ColdFusion 2018 later than Update 16, e.g. Update 17; 2021 later than Update 6, e.g. Update 7; and the patched 2023 hotfix newer than build 330468) or follow Adobe's advisory instructions, as CISA requires mitigations or discontinuation of use for KEV entries. Until patched, restrict network access to ColdFusion Administrator/CFIDE endpoints from untrusted networks. Because no authentication or interaction is required, review access logs for unauthenticated requests to admin CFM/CFC endpoints and assume possible compromise on unpatched, internet-facing servers.