Pierluigi Paganini September 25, 2019

Adobe released security updates to address three severe vulnerabilities in its ColdFusion web application development platform

Adobe released ColdFusion 2016 Update 12 and ColdFusion 2018 Update 5 to address three severe vulnerabilities in its ColdFusion web application development platform, two of them have been rated as “critical.”

“Adobe has released security updates for ColdFusion versions 2018 and 2016. These updates resolve two critical and one important vulnerability that could lead to arbitrary code execution.” reads the security advisory.

The two critical issues are a path traversal vulnerability, tracked as CVE-2019-8074, that can be exploited to bypass access controls and a command injection flaw, tracked as CVE-2019-8073, that can be exploited to execute arbitrary code on the target machine.

The CVE-2019-8072 was reported by Pete Freitag from Foundeo Inc., CVE-2019-8073 by Badcode of Knownsec 404 Team.

The third flaw addressed by Adobe is a security bypass that can lead to information disclosure, it was rated as “important.” The vulnerability is tracked as CVE-2019-8074 and was discovered by Daniel Underhay of Aura Information Security.

The good news is that Adobe is not aware of attacks in the wild exploiting the above vulnerabilities.

Two weeks ago, Adobe released the September 2019 Patch Tuesday updates that addressed two code execution bugs in Flash Player and a DLL hijacking flaw in Application Manager.

Pierluigi Paganini

(SecurityAffairs – ColdFusion, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]