Exploited 0-days, an incomplete fix, and a botched disclosure: Infosec snafu reigns
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-29300 | Deserialization of Untrusted Data RCE in Adobe ColdFusion (CVE-2023-29300) | 9.8 | 100% | KEVRansomware | KEV |
From the original article
1 min read at arstechnica.com
In fact, Adobe had not patched the mislabeled vulnerability, which Project Discovery warned posed a “significant threat, allowing malicious actors to execute arbitrary code on vulnerable ColdFusion 2018, 2021, and 2023 installations without the need for prior authentication.”
arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.