Three New Tags For Cold Fusion (CVE-2023-29298; CVE-2023-29300) and Citrix (CVE-2023-3519)
Summary: GreyNoise released detection tags for three vulnerabilities: Citrix ADC/NetScaler CVE-2023-3519, an unauthenticated RCE affecting several versions of Citrix ADC and Citrix Gateway; Adobe ColdFusion CVE-2023-29298, an improper access control flaw (CVSS 7.5) in versions 2018u16, 2021u6 and 2023.0.0.330468 and earlier that lets an attacker reach administration CFM and CFC endpoints without user interaction; and ColdFusion CVE-2023-29300, a deserialization of untrusted data flaw (CVSS 9.8) in the same versions that allows arbitrary code execution without user interaction. All three are listed in CISA's Known Exploited Vulnerabilities Catalog, meaning they have been observed exploited in the wild.
What you should know: CVE-2023-3519 requires no authentication and can serve as an initial access vector for ransomware, while CVE-2023-29300 carries a CVSS score of 9.8 and needs no user interaction - and all three are already being exploited, not merely theoretical.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-29298CVE-2023-29300CVE-2023-3519
- Related
- CVE-2023-29300: Adobe Cold Fusion Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Jan 08, 2024CVE-2023-29298: Adobe Cold Fusion Improper Access Control Vulnerability Known Exploited Vulnerabilities · Jul 20, 2023CVE-2023-3519: Citrix Net Scaler ADC and Net Scaler Gateway Code Injection Vulnerability Known Exploited Vulnerabilities · Jul 19, 2023