Description

Due to a vulnerability in ColdFusion components(.cfc) metadata handling, an unauthenticated attacker can execute arbitrary code or read files on the server

Remediation

Upgrade to the latest version of Adobe ColdFusion

References

Security updates available for Adobe ColdFusion | APSB23-25

CVE-2023-26359

Related Vulnerabilities

WordPress Plugin Smash Balloon Social Post Feed Cross-Site Scripting (4.1)

Internet Information Services Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-1999-0349)

WordPress Permissions, Privileges, and Access Controls Vulnerability (CVE-2009-2854)

WordPress Plugin Modula Image Gallery Cross-Site Scripting (2.2.4)

WordPress Plugin Page Restrict Open Redirect (2.2.3)

Severity

High

Classification

CVE-2023-26359 CVE-2023-26360 CWE-502 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Insecure Deserialization Code Execution Known Vulnerabilities Missing Update