{"id":"CVE-2023-38206","published":"2023-09-14T07:40:06Z","modified":"2025-02-27T20:52:32Z","title":"ColdFusion | Improper Access Control (CWE-284)","vendor":"Adobe","product":"ColdFusion","tier":"tail","description":{"text":"Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints resulting in a low-confidentiality impact. Exploitation of this issue does not require user interaction.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00704,"percentile":0.53172,"provenance":"source"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://helpx.adobe.com/security/products/coldfusion/apsb23-47.html","tags":["vendor-advisory"]}],"priority":{"score":14.3,"factors":[{"name":"EPSS percentile","points":10.63},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"adobe","affectedVersions":[{"vendor":"Adobe","product":"ColdFusion","versions":["<= cf2023U2"]}],"euvd":{"id":"EUVD-2023-42026","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-adobe-coldfusion-cwe-284"}}