CVE-2023-38203

Vulnerability updated 5 months ago (2024-05-04T22:18:25.659Z)
Download STIX
Preview STIX
CVE-2023-38203 is a critical software vulnerability in Adobe ColdFusion, which allows an attacker to bypass authentication, remotely execute commands, and install webshells on vulnerable servers. The flaw was first detected by Rapid7 on July 13, when threat actors were found exploiting it alongside another vulnerability, CVE-2023-29298. Additionally, an unpublished related vulnerability, CVE-2023-38203, was also being actively exploited. In a separate incident, Project Discovery disclosed an n-day exploit for what they believed to be CVE-2023-29300, which Adobe patched with an out-of-band update on July 14. This vulnerability (CVE-2023-38203) enabled remote code execution through deserialization, which acted as a bypass for CVE-2023-29300. This led to the discovery of a new 0-day vulnerability, further increasing the risk to systems running Adobe ColdFusion. The exploitation of this flaw could potentially provide unauthorized access to sensitive information and control over affected systems, posing a significant security threat. To mitigate the risks associated with this vulnerability, Adobe has released security updates addressing CVE-2023-38203. These updates are crucial for preventing potential system takeovers by attackers exploiting these vulnerabilities. All users and administrators are strongly advised to apply these updates promptly to protect their systems from potential breaches.
Description last updated: 2024-05-04T22:03:29.604Z
What's your take? (Question 1 of 4)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Coldfusion
Adobe
Vulnerability
Rapid7
Exploit
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Source Document References
Information about the CVE-2023-38203 Vulnerability was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
CERT-EU
9 months ago
CERT-EU
9 months ago
CERT-EU
9 months ago
Securityaffairs
9 months ago
CERT-EU
9 months ago
CERT-EU
9 months ago
CERT-EU
9 months ago
CERT-EU
a year ago
Fortinet
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
Securityaffairs
a year ago
CISA
a year ago
CERT-EU
a year ago
InfoSecurity-magazine
a year ago
BankInfoSecurity
a year ago
CERT-EU
a year ago