Adobe has launched out-of-band safety updates to handle a important ColdFusion vulnerability with proof-of-concept (PoC) exploit code.
In an advisory launched on Monday, the corporate says the flaw (tracked as CVE-2024-53961) is brought on by a path traversal weak point that impacts Adobe ColdFusion variations 2023 and 2021 and might allow attackers to learn arbitrary information on weak servers.
“Adobe is conscious that CVE-2024-53961 has a recognized proof-of-concept that might trigger an arbitrary file system learn,” Adobe stated immediately, whereas additionally cautioning prospects that it assigned a “Precedence 1” severity ranking to the flaw as a result of it has a “a better danger of being focused, by exploit(s) within the wild for a given product model and platform.”
The corporate advises directors to put in immediately’s emergency safety patches (ColdFusion 2021 Replace 18 and ColdFusion 2023 Replace 12) as quickly as doable, “for instance, inside 72 hours,” and apply safety configuration settings outlined within the ColdFusion 2023 and ColdFusion 2021 lockdown guides.
Whereas Adobe has but to reveal if this vulnerability has been exploited within the wild, it suggested prospects immediately to assessment its up to date serial filter documentation for extra data on blocking insecure Wddx deserialization assaults.
As CISA warned in Might when it urged software program firms to weed out path traversal safety bugs earlier than delivery their merchandise, attackers can exploit such vulnerabilities to entry delicate information, together with credentials that can be utilized to brute-force already present accounts and breach a goal’s programs.
“Vulnerabilities like listing traversal have been known as ‘unforgivable’ since not less than 2007. Regardless of this discovering, listing traversal vulnerabilities (similar to CWE-22 and CWE-23) are nonetheless prevalent lessons of vulnerability,” CISA stated.
Final yr, in July 2023, CISA additionally ordered federal businesses to safe their Adobe ColdFusion servers by August tenth in opposition to two important safety flaws (CVE-2023-29298 and CVE-2023-38205) exploited in assaults, certainly one of them as a zero-day.
The U.S. cybersecurity company additionally revealed one yr in the past that hackers had been utilizing one other important ColdFusion vulnerability (CVE-2023-26360) to breach outdated authorities servers since June 2023. The identical flaw had been actively exploited in “very restricted assaults” as a zero-day since March 2023.
