Adobe ColdFusion vulnerabilities exploited to deliver web shells (CVE-2023-29298, CVE-2023-38203)
60
CVE-2023-29301
—1CVSS 3.1
7.5 high
EPSS
35%p98
Published
()
Modified
Description
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the confidentiality of the user. Exploitation of this issue does not require user interaction.
- Vendors
- adobe
- Products
- coldfusion
- Weakness
- CWE-307
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
In the news2 stories
Adobe warns customers of critical ColdFusion RCE exploited in attacks
60