gsd-2023-38203
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2023-38203",
"id": "GSD-2023-38203"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2023-38203"
],
"details": "Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.",
"id": "GSD-2023-38203",
"modified": "2023-12-13T01:20:35.940670Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "psirt@adobe.com",
"ID": "CVE-2023-38203",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "ColdFusion",
"version": {
"version_data": [
{
"version_value": "not down converted",
"x_cve_json_5_version_data": {
"defaultStatus": "affected",
"versions": [
{
"lessThanOrEqual": "cf2023U1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
}
]
}
}
]
},
"vendor_name": "Adobe"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction."
}
]
},
"impact": {
"cvss": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "NETWORK",
"modifiedAvailabilityImpact": "HIGH",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "HIGH",
"modifiedPrivilegesRequired": "NONE",
"modifiedScope": "NOT_DEFINED",
"modifiedUserInteraction": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"cweId": "CWE-502",
"lang": "eng",
"value": "Deserialization of Untrusted Data (CWE-502)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://helpx.adobe.com/security/products/coldfusion/apsb23-41.html",
"refsource": "MISC",
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb23-41.html"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
},
"nvd.nist.gov": {
"cve": {
"cisaActionDue": "2024-01-29",
"cisaExploitAdd": "2024-01-08",
"cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Adobe ColdFusion Deserialization of Untrusted Data Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*",
"matchCriteriaId": "3B54B2B0-B1E1-4B4E-A529-D0BD3B5DEEF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*",
"matchCriteriaId": "EDB126BF-E09D-4E58-A39F-1190407D1CAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*",
"matchCriteriaId": "8DDD85DF-69A0-476F-8365-CD67C75CF0CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:*",
"matchCriteriaId": "23F63675-7817-4AF0-A7DB-5E35EDABF04E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:*",
"matchCriteriaId": "3E3BF53E-2C0D-4F79-8B62-4C2A50CB5F52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:*",
"matchCriteriaId": "C26BF72C-E991-4170-B68B-09B20B6C0679",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:*",
"matchCriteriaId": "25B4B4F2-318F-4046-ADE5-E9DD64F83FD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update15:*:*:*:*:*:*",
"matchCriteriaId": "831E8D69-62E9-4778-8CC5-D6D45CF5AB6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update16:*:*:*:*:*:*",
"matchCriteriaId": "2F549BB3-25AB-4C83-B608-3717EADAAB35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update17:*:*:*:*:*:*",
"matchCriteriaId": "907F11B7-56C6-49F1-BC7B-E86B35346FD3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*",
"matchCriteriaId": "59649177-81EE-43C3-BFA5-E56E65B486DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*",
"matchCriteriaId": "453B96ED-738A-4642-B461-C5216CF45CA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*",
"matchCriteriaId": "58D32489-627B-4E49-9329-8A3B8F8E4903",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*",
"matchCriteriaId": "6D5860E1-D293-48FE-9796-058B78B2D571",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*",
"matchCriteriaId": "9F9336CC-E38F-4BCB-83CD-805EC7FEF806",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*",
"matchCriteriaId": "97964507-047A-4CC8-8D2B-0EA0C7F9BD50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*",
"matchCriteriaId": "82208628-F32A-4380-9B0F-DC8507E7701D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*",
"matchCriteriaId": "1563CE5E-A4F7-40A4-A050-BB96E332D8DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*",
"matchCriteriaId": "7A94B406-C011-4673-8C2B-0DD94D46CC4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*",
"matchCriteriaId": "AFD05E3A-10F9-4C75-9710-BA46B66FF6E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*",
"matchCriteriaId": "D57C8681-AC68-47DF-A61E-B5C4B4A47663",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*",
"matchCriteriaId": "75608383-B727-48D6-8FFA-D552A338A562",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*",
"matchCriteriaId": "7773DB68-414A-4BA9-960F-52471A784379",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*",
"matchCriteriaId": "B38B9E86-BCD5-4BCA-8FB7-EC55905184E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*",
"matchCriteriaId": "5E7BAB80-8455-4570-A2A2-8F40469EE9CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*",
"matchCriteriaId": "F9D645A2-E02D-4E82-A2BD-0A7DE5B8FBCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*",
"matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*",
"matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction."
}
],
"id": "CVE-2023-38203",
"lastModified": "2024-01-09T02:00:01.953",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "psirt@adobe.com",
"type": "Primary"
}
]
},
"published": "2023-07-20T16:15:12.180",
"references": [
{
"source": "psirt@adobe.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb23-41.html"
}
],
"sourceIdentifier": "psirt@adobe.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "psirt@adobe.com",
"type": "Primary"
}
]
}
}
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.