Adobe ColdFusion Access Control Bypass (CVE-2023-26347, CVE-2023-38205)

What is the vulnerability?
The Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by Improper Access Control vulnerabilities that could result in a security bypass. Exploitation of these vulnerabilities could give attacker access to the ColdFusion Administrator endpoints for further attack.

What is the Vendor Solution?


Adobe released patches for the security bypass flaws in June 2023. [ Link ]

What FortiGuard Coverage is available?

FortiGuard Labs has an IPS signature "Adobe.ColdFusion.IPFilterUtils.Authentication.Bypass" to protect any exploitations …

access access control adobe adobe coldfusion attack attacker bypass coldfusion control cve endpoints exploitation patches result security security bypass solution vendor vulnerabilities vulnerability what is