{"id":"CVE-2023-38204","published":"2023-09-14T07:40:13Z","modified":"2025-02-27T20:52:25Z","title":"Bypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8","vendor":"Adobe","product":"ColdFusion","tier":"core","eol":null,"affectedVersions":[{"vendor":"Adobe","product":"ColdFusion","versions":["<= cf2023U2"]}],"description":{"text":"Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.","provenance":"source","from":"CVE.org"},"summary":{"text":"A deserialization of untrusted data flaw exists in Adobe ColdFusion versions 2018u18 and earlier, 2021u8 and earlier, and 2023u2 and earlier. An attacker who can reach the service over the network can achieve arbitrary code execution, and no authentication or user interaction is needed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:46Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.66939,"percentile":0.99293,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-08-30","exploitedFirstSeen":"2023-08-30","ransomware":false,"evidence":[{"url":"https://www.fortinet.com/blog/threat-research/multiple-threats-target-adobe-coldfusion-vulnerabilities","date":"2023-08-30"},{"url":"https://www.labs.greynoise.io/grimoire/2025-12-26-coldfusion/","date":"2025-12-26"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"pppppppppppppppppppp","url":"https://otx.alienvault.com/pulse/695258530fd8437695a3c6f3","created":"2025-12-29"},{"name":"ACTUALIZACION | Security updates available for Adobe ColdFusion | APSB23-47","url":"https://otx.alienvault.com/pulse/64bc3dbad1071a81f7f9279e","created":"2023-07-22"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://helpx.adobe.com/security/products/coldfusion/apsb23-47.html","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-42024","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-42024","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-08-30","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fortinet.com/blog/threat-research/multiple-threats-target-adobe-coldfusion-vulnerabilities","provenance":"source"},{"date":"2023-09-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-38204","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":62.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1156 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.86,"detail":"percentile 0.9929"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-adobe-coldfusion-cwe-502"}}