{"id":"CVE-2023-26347","published":"2023-11-17T13:31:33Z","modified":"2024-10-21T14:17:57Z","title":"CVE-2023-38205 issues | ColdFusion Admin Panel Access","vendor":"Adobe","product":"ColdFusion","tier":"core","eol":null,"affectedVersions":[{"vendor":"Adobe","product":"ColdFusion","versions":["<= 2021.11"]}],"description":{"text":"Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.","provenance":"source","from":"CVE.org"},"summary":{"text":"Adobe ColdFusion has an improper access control flaw that lets it bypass a security feature and reach its administration endpoints. The attack needs no authentication and no user interaction, and an unauthenticated attacker can reach the administration CFM and CFC endpoints remotely over the network.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T22:22:03Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.10072,"percentile":0.9563,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-05-06","exploitedFirstSeen":"2024-05-06","ransomware":false,"evidence":[{"url":"https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/threat-landscape-report-2h-2023.pdf","date":"2024-05-06"},{"url":"https://go.catonetworks.com/rs/245-RJK-441/images/CATO_CTRL_Report_Q3_2024.pdf","date":"2024-11-20"},{"url":"https://www.labs.greynoise.io/grimoire/2025-12-26-coldfusion/","date":"2025-12-26"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"pppppppppppppppppppp","url":"https://otx.alienvault.com/pulse/695258530fd8437695a3c6f3","created":"2025-12-29"}],"provenance":"machine"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-30168","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-30168","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2023-26347","name":"Adobe Coldfusion - Authentication Bypass","severity":"high","path":"http/cves/2023/CVE-2023-26347.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26347.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-11-17","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-26347","provenance":"source"},{"date":"2024-05-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/threat-landscape-report-2h-2023.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":65.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 908 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.13,"detail":"percentile 0.9563"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-adobe-coldfusion-cwe-284"}}