CVE-2023-29298
HighPublished
Adobe ColdFusion Improper Access Control Security feature bypass
- Published
- Jul 12, 2023
- Updated
- Oct 21, 2025
- Assigning CNA
- adobe
- Evidence observed
- Jul 20, 2023
Primary CVSS
7.5/ 10High
Adobe ColdFusion Improper Access Control Security feature bypass
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NHigh · next 30 days
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
http/cves/2023/CVE-2023-29298.yaml
Adobe ColdFusion CVE-2023-26360/CVE-2023-29298 Automated Reverse Shell
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.