CVE-2023-44352: Adobe ColdFusion reflected XSS via crafted URL

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityAlthough CVSS is medium, the very high EPSS score and unauthenticated network reachability with user interaction make exploitation attempts likely and impactful.

What it is

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier contain a reflected cross-site scripting flaw. An unauthenticated attacker can craft a URL that, when visited by a victim, executes malicious JavaScript in the victim's browser context. The issue matters because it can be used for session theft, credential phishing, or actions performed as the victim.

Impact

An attacker can execute arbitrary JavaScript in the victim's browser within the ColdFusion site's origin, potentially stealing session cookies or performing actions as the victim. The scope change in the CVSS vector indicates the impact can extend beyond the vulnerable component.

Attack surface

Reachable over the network via a crafted URL referencing a vulnerable ColdFusion page; no authentication is required, but the victim must be convinced to visit the link (user interaction required).

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is very high (0.848, 99.7th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Apply the Adobe ColdFusion security update referenced in APSB23-52 or upgrade to a fixed version.
• If immediate patching is not possible, restrict network access to ColdFusion administrative and application endpoints to trusted sources.
• Deploy a web application firewall or input filtering to block reflected script payloads in request parameters.
• Set session cookies with HttpOnly and Secure attributes to reduce impact of successful XSS.
• Educate users not to click untrusted links that target ColdFusion applications.

Detection

• Monitor web server and WAF logs for requests containing script tags, event handlers, or encoded JavaScript in query parameters or paths.
• Alert on outbound or inline script execution anomalies in ColdFusion application responses.
• Review browser or endpoint telemetry for unexpected JavaScript execution originating from ColdFusion URLs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.