Adobe Patches two critical vulnerabilities in ColdFusion

Adobe released security updates to address three severe vulnerabilities in its ColdFusion web application development platform

Adobe released ColdFusion 2016 Update 12 and ColdFusion 2018 Update 5 to address three severe vulnerabilities in its ColdFusion web application development platform, two of them have been rated as “critical.”

“Adobe has released security updates for ColdFusion versions 2018 and 2016. These updates resolve two critical and one important vulnerability that could lead to arbitrary code execution.” reads the security advisory.

The two critical issues are a path traversal vulnerability, tracked as CVE-2019-8074, that can be exploited to bypass access controls and a command injection flaw, tracked as CVE-2019-8073, that can be exploited to execute arbitrary code on the target machine.

The CVE-2019-8072 was reported by Pete Freitag from Foundeo Inc., CVE-2019-8073 by Badcode of Knownsec 404 Team.

The third flaw addressed by Adobe is a security bypass that can lead to information disclosure, it was rated as “important.” The vulnerability is tracked as CVE-2019-8074 and was discovered by Daniel Underhay of Aura Information Security.

The good news is that Adobe is not aware of attacks in the wild exploiting the above vulnerabilities.

Two weeks ago, Adobe released the September 2019 Patch Tuesday updates that addressed two code execution bugs in Flash Player and a DLL hijacking flaw in Application Manager.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – ColdFusion, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.