{"cve":"CVE-2023-29298","epss":{"score":0.9979},"kev":{"dateAdded":"2023-07-20T00:00:00+00:00","dueDate":"2023-08-10T00:00:00+00:00"},"mitre":{"cpes":[],"created":"2023-07-12T15:46:07.094000+00:00","description":"Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cvssV4_0":{}},"mitre_repo_path":"cves/2023/29xxx/CVE-2023-29298.json","references":["https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html"],"title":"Adobe ColdFusion Improper Access Control Security feature bypass","updated":"2025-10-21T23:05:42.991000+00:00","vendors":[],"weaknesses":["CWE-284"]},"nvd":{"cpes":["cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update15:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update16:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*"],"created":"2023-07-12T16:15:11.623000+00:00","description":"Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cvssV4_0":{}},"nvd_repo_path":"2023/CVE-2023-29298.json","references":["https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29298"],"title":null,"updated":"2026-06-17T05:49:44.727000+00:00","vendors":["adobe","adobe$PRODUCT$coldfusion"],"weaknesses":["CWE-284","NVD-CWE-Other"]},"opencve":{"changes":[{"created":"2025-02-04T17:15:00+00:00","data":[{"details":{"added":{"kev":{"dateAdded":"2023-07-20"},"ssvc":{"options":{"Automatable":"yes","Exploitation":"active","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"b8f65603-1443-494f-b7bd-6b58881acc39"},{"created":"2025-02-13T18:00:00+00:00","data":[{"details":{"added":["cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*"],"removed":["cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*"]},"type":"cpes"}],"id":"29040f12-ad6a-4cfa-bfa7-29f8bac9349d"},{"created":"2025-10-21T19:30:00+00:00","data":[{"details":{"added":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29298"],"removed":[]},"type":"references"}],"id":"6ec6358d-a3a3-4169-ab22-97851b7a9a75"},{"created":"2025-10-21T20:30:00+00:00","data":[{"details":{"added":[],"removed":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29298"]},"type":"references"}],"id":"8030fb45-be22-432d-bf4c-c48f43ec2ad0"},{"created":"2025-10-21T23:30:00+00:00","data":[{"details":{"added":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29298"],"removed":[]},"type":"references"}],"id":"04d228b0-2f65-479b-99de-254609816413"}],"cpes":{"data":["cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update15:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update16:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*","cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2023-07-12T15:46:07.094000+00:00","provider":"mitre"},"description":{"data":"Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.9979},"provider":"first"},"kev":{"data":{"dateAdded":"2023-07-20T00:00:00+00:00","dueDate":"2023-08-10T00:00:00+00:00"},"provider":"cisa"},"ssvc":{"data":{"options":{"Automatable":"yes","Exploitation":"active","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29298"],"providers":["mitre","nvd","vulnrichment"]},"title":{"data":"Adobe ColdFusion Improper Access Control Security feature bypass","provider":"mitre"},"updated":{"data":"2025-10-23T11:11:19.167000+00:00","provider":"nvd"},"vendors":{"data":["adobe","adobe$PRODUCT$coldfusion"],"providers":["nvd"]},"weaknesses":{"data":["CWE-284","NVD-CWE-Other"],"providers":["mitre","nvd"]}},"vulnrichment":{"cpes":[],"created":"2023-07-12T15:46:07.094000+00:00","description":"Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{"dateAdded":"2023-07-20"},"ssvc":{"options":{"Automatable":"yes","Exploitation":"active","Technical Impact":"partial"},"version":"2.0.3"}},"references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29298"],"title":"Adobe ColdFusion Improper Access Control Security feature bypass","updated":"2025-02-04T16:13:41.740000+00:00","vendors":[],"vulnrichment_repo_path":"2023/29xxx/CVE-2023-29298.json","weaknesses":[]}}