CVE-2023-38205

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Adobe	ColdFusion	<= cf2023U2

References

https://helpx.adobe.com/security/products/coldfusion/apsb23-47.htmlVendor Advisory
https://helpx.adobe.com/security/products/coldfusion/apsb23-47.htmlVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38205Third Party Advisory, US Government Resource

Timeline

Published: Sep 14, 2023
Last modified: Jun 17, 2026
Added to CISA KEV: Jul 20, 2023
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-382065.3Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vu CVE-2023-382077.5Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by a XML Injection (aka Blind CVE-2023-382087.2Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Improper Neutralization CVE-2023-382096.5Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization CVE-2023-38215.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4.CVE-2023-382105.5Adobe XMP Toolkit versions 2022.06 is affected by a Uncontrolled Resource Consumption vulnerability. An unauthenticated attacker could lever CVE-2023-382117.8Adobe Dimension version 3.4.9 is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of CVE-2023-382127.8Adobe Dimension version 3.4.9 is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the CVE-2023-382135.5Adobe Dimension version 3.4.9 is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac CVE-2023-382145.4Adobe Experience Manager versions 6.5.17 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileg CVE-2023-382155.4Adobe Experience Manager versions 6.5.17 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileg CVE-2023-382165.5Adobe Bridge versions 12.0.4 (and earlier) and 13.0.3 (and earlier) are affected by a Use After Free vulnerability that could lead to disclo