First published: Thu Mar 23 2023(Updated: )
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
Credit: psirt@adobe.com
Affected Software | Affected Version | How to fix |
---|---|---|
Adobe ColdFusion | =2018 | |
Adobe ColdFusion | =2018-update1 | |
Adobe ColdFusion | =2018-update10 | |
Adobe ColdFusion | =2018-update11 | |
Adobe ColdFusion | =2018-update12 | |
Adobe ColdFusion | =2018-update13 | |
Adobe ColdFusion | =2018-update14 | |
Adobe ColdFusion | =2018-update15 | |
Adobe ColdFusion | =2018-update2 | |
Adobe ColdFusion | =2018-update3 | |
Adobe ColdFusion | =2018-update4 | |
Adobe ColdFusion | =2018-update5 | |
Adobe ColdFusion | =2018-update6 | |
Adobe ColdFusion | =2018-update7 | |
Adobe ColdFusion | =2018-update8 | |
Adobe ColdFusion | =2018-update9 | |
Adobe ColdFusion | =2021 | |
Adobe ColdFusion | =2021-update1 | |
Adobe ColdFusion | =2021-update2 | |
Adobe ColdFusion | =2021-update3 | |
Adobe ColdFusion | =2021-update4 | |
Adobe ColdFusion | =2021-update5 | |
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2023-26359 is a vulnerability in Adobe ColdFusion that allows for code execution by exploiting the deserialization of untrusted data.
The vulnerability occurs due to a flaw in the deserialization process of untrusted data, allowing an attacker to execute arbitrary code in the context of the current user.
CVE-2023-26359 has a severity rating of critical.
To fix the vulnerability, Adobe has released a security update. It is recommended to update to the latest version of Adobe ColdFusion as soon as possible.
You can find more information about CVE-2023-26359 on Adobe's official security bulletin at the following link: <a href='https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html'>https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html</a>