CVE-2023-38203: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Other sources
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-38203?
CVE-2023-38203 is a Deserialization of Untrusted Data vulnerability in Adobe ColdFusion versions 2018u17, 2021u7, and 2023u1.
How severe is CVE-2023-38203?
CVE-2023-38203 has a severity rating of 9 (critical).
How can CVE-2023-38203 be exploited?
Exploitation of CVE-2023-38203 does not require user interaction.
What is the affected software?
Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier), and 2023u1 (and earlier) are affected by CVE-2023-38203.
How can I fix CVE-2023-38203?
To fix CVE-2023-38203, update to a version of Adobe ColdFusion that is later than 2018u17, 2021u7, or 2023u1.