What is CVE-2023-38205?

CVE-2023-38205 is a high-severity vulnerability affecting Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier), and 2023u2 (and earlier). This improper access control vulnerability could lead to a security feature bypass, allowing attackers to access administration CFM and CFC endpoints without user interaction. Adobe has acknowledged that this vulnerability has been exploited in limited attacks targeting ColdFusion systems. Organizations running affected versions should prioritize addressing this vulnerability to protect their systems and data.

Who is impacted by CVE-2023-38205?

CVE-2023-38205 affects users of Adobe ColdFusion versions 2018u18 and earlier, 2021u8 and earlier, and 2023u2 and earlier. This security issue allows attackers to bypass security features and access administration endpoints without user interaction. Users of these Adobe ColdFusion versions should be aware of this vulnerability and its potential impact on their systems.

What to do if CVE-2023-38205 affected you

If you're affected by the CVE-2023-38205 vulnerability, it's crucial to take immediate action to protect your systems. Follow these steps:

1. Update ColdFusion to the latest version

2. Apply security configuration settings as outlined on the ColdFusion Security page

3. Review the respective Lockdown guides

4. Update ColdFusion JDK/JRE LTS version to the latest update release

5. Check the ColdFusion support matrix for the supported JDK version

6. Apply the ColdFusion update without a corresponding JDK update to secure the server

7. Follow the relevant Tech Notes for more details

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-38205 vulnerability, known as Adobe ColdFusion Improper Access Control Vulnerability, is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. It was added on July 20, 2023, and the due date for required action is August 10, 2023. Organizations should apply mitigations as per vendor instructions or discontinue using the affected product if mitigations are unavailable.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-284, which is an Improper Access Control issue affecting Adobe ColdFusion.

Learn More

For a comprehensive understanding of this vulnerability, consult the NVD page and the resources listed below.

• Adobe Security Bulletin

• BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

• Known Exploited Vulnerabilities Catalog