CVE-2023-38205
Adobe ColdFusion Improper Access Control Vulnerability
Description
CVE-2023-38205 is an improper access control vulnerability in Adobe ColdFusion that allows attackers to bypass security features and access administrative CFM and CFC endpoints. This vulnerability affects Adobe ColdFusion versions 2018 Update 18 and earlier, 2021 Update 8 and earlier, and 2023 Update 2 and earlier. By exploiting this access control flaw, an unauthenticated attacker can reach sensitive administration interfaces that should be restricted, potentially exposing server configuration and application data. CISA has added CVE-2023-38205 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and the EPSS score of 94.3% indicates near-certain exploitation activity. Organizations running Adobe ColdFusion should treat this improper access control vulnerability as a high-priority security concern.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | coldfusion | 2018; 2021; 2023 |
References
- https://helpx.adobe.com/security/products/coldfusion/apsb23-47.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38205(Third Party Advisory, US Government Resource)
Weakness Type
CWE-284: Improper Access Control
Improper access control occurs when an application fails to properly restrict access to resources or functionality. In the context of CVE-2023-38205, Adobe ColdFusion does not adequately enforce access restrictions on its administrative CFM and CFC endpoints, allowing unauthorized users to bypass security controls and reach sensitive administration functions.
Learn more: CWE-284 — Improper Access Control
Impact Analysis
CVE-2023-38205 is remotely exploitable without physical access, as the attack vector is network-based. The vulnerability is easy to exploit with no special conditions needed, requires no authentication, and no user interaction is necessary for successful exploitation. Confidentiality (High): An attacker can access sensitive administrative endpoints, potentially exposing server configurations, application source code, data source credentials, and other confidential information managed through ColdFusion's administration interface. Integrity (None) and Availability (None): While the vulnerability primarily enables unauthorized read access rather than data modification or service disruption, the exposed administrative endpoints could serve as a stepping stone for further attacks. With a CVSS score of 7.5 (High severity) and an EPSS score of 94.3%, this vulnerability poses a significant and actively exploited threat to any internet-facing Adobe ColdFusion deployment.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-38205 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 10, 2023. The EPSS score of 94.3% places this vulnerability in the 99.9th percentile, indicating near-certain exploitation activity across the threat landscape. While no public exploit code tagged as such appears in the NVD references, the confirmed active exploitation and extremely high EPSS score mean that attackers are already leveraging this Adobe ColdFusion access control bypass in real-world campaigns. Security teams should act immediately to mitigate this vulnerability.
Remediation
- Apply vendor patches immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Refer to Adobe's security bulletin APSB23-47 for the specific patches.
- Upgrade Adobe ColdFusion to the latest patched versions: ColdFusion 2018 Update 19 or later, ColdFusion 2021 Update 9 or later, or ColdFusion 2023 Update 3 or later.
- Restrict access to ColdFusion administrative endpoints by implementing network-level controls such as IP allowlisting, placing the ColdFusion Administrator behind a VPN, and using WAF rules to block unauthorized requests to /CFIDE/administrator/ and other administrative paths.
- Review access logs for signs of unauthorized access to CFM and CFC administration endpoints. Look for unusual requests to /CFIDE/, /CFIDE/administrator/, or other administrative paths from unexpected IP addresses.
- Implement defense-in-depth access controls by configuring ColdFusion's built-in security features, disabling unnecessary administrative endpoints, and enforcing the principle of least privilege for all ColdFusion server configurations.
Technical Details
CVE-2023-38205 exploits an improper access control weakness (CWE-284) in Adobe ColdFusion's handling of requests to administrative CFM and CFC endpoints. The vulnerability allows an unauthenticated remote attacker to send specially crafted HTTP requests over the network that bypass the intended access restrictions on these sensitive endpoints. As reflected in the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), the attack requires no privileges, no user interaction, and is of low complexity, while providing high confidentiality impact — the attacker gains read access to administrative interfaces and their associated data. The scope remains unchanged, meaning the vulnerability is confined to the ColdFusion application itself, though the information gained from administrative access could facilitate further attacks against the broader infrastructure.
Frequently Asked Questions
Is CVE-2023-38205 being actively exploited?
Yes, CVE-2023-38205 is being actively exploited. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog and set a remediation deadline of August 10, 2023. The EPSS score of 94.3% (99.9th percentile) further confirms widespread exploitation activity targeting Adobe ColdFusion installations.
What products are affected by CVE-2023-38205?
CVE-2023-38205 affects Adobe ColdFusion across three major version lines: ColdFusion 2018 Update 18 and earlier, ColdFusion 2021 Update 8 and earlier, and ColdFusion 2023 Update 2 and earlier. All installations of these versions that expose ColdFusion administrative endpoints are potentially vulnerable.
How do I fix CVE-2023-38205?
Apply the patches provided by Adobe in security bulletin APSB23-47, upgrading to ColdFusion 2018 Update 19+, 2021 Update 9+, or 2023 Update 3+. Additionally, restrict network access to ColdFusion administrative endpoints using firewalls, VPN, or IP allowlisting. See the Remediation section for detailed steps.
How severe is CVE-2023-38205?
CVE-2023-38205 is rated High severity with a CVSS score of 7.5 out of 10. The EPSS score of 94.3% places it in the 99.9th percentile, meaning it is more likely to be exploited than nearly all other known vulnerabilities. The combination of active exploitation, ease of attack, and access to sensitive administrative functions makes this a high-priority security issue.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.