Adobe out-of-band update addresses an actively exploited ColdFusion zero-day

Adobe released an emergency update to address critical vulnerabilities in ColdFusion, including an actively exploited zero-day.

Adobe released an out-of-band update to address critical and moderate vulnerabilities in ColdFusion, including a zero-day flaw that is actively exploited in attacks.

 The vulnerabilities could lead to arbitrary code execution and security feature bypass. The impacted ColdFusion versions are 2023, 2021 and 2018.

Below is the list of the issues addressed by the software firm with this out-of-band update:

Vulnerability Category	Vulnerability Impact	Severity	CVSS base score	CVSS vector	CVE Numbers
Deserialization of Untrusted Data (CWE-502)	Arbitrary code execution	Critical	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CVE-2023-38204
Improper Access Control (CWE-284)	Security feature bypass	Critical	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CVE-2023-38205
Improper Access Control (CWE-284)	Security feature bypass	Moderate	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	CVE-2023-38206

According to the bulletin, the vulnerability tracked as CVE-2023-38205 has been exploited in the wild in limited attacks targeting ColdFusion. This flaw is an Improper Access Control that could lead to a security feature bypass.

“Adobe has released security updates for ColdFusion versions 2023, 2021 and 2018. These updates resolve critical  and moderate vulnerabilities that could lead to arbitrary code execution and security feature bypass.” reads the security bulletin. “Adobe is aware that CVE-2023-38205 has been exploited in the wild in limited attacks targeting Adobe ColdFusion.”

The CVE-2023-38205 vulnerability was discovered by Stephen Fewer from security firm Rapid7.

The CVE-2023-38205 vulnerability is a patch bypass for the fix for the ColdFusion authentication bypass issue tracked as CVE-2023-29298.

Last week, Adobe warned customers of a critical ColdFusion pre-authentication RCE bug, tracked as CVE-2023-29300, which is actively exploited. The issue was part of an exploit chain, that included the CVE-2023-29298 and CVE-2023-38203, which was used to deploy webshells on vulnerable ColdFusion servers.

BllepingComputer confirmed that the fix for CVE-2023-29298 is included in APSB23-47 as the CVE-2023-38205 patch.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Adobe)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.