Adobe has launched out-of-band safety updates to handle a important ColdFusion vulnerability with proof-of-concept (PoC) exploit code.
In an advisory launched on Monday, the corporate says the flaw (tracked as CVE-2024-53961) is attributable to a path traversal weak spot that impacts Adobe ColdFusion variations 2023 and 2021 and may allow attackers to learn arbitrary information on weak servers.
“Adobe is conscious that CVE-2024-53961 has a identified proof-of-concept that might trigger an arbitrary file system learn,” Adobe stated as we speak, whereas additionally cautioning prospects that it assigned a “Precedence 1” severity score to the flaw as a result of it has a “a better danger of being focused, by exploit(s) within the wild for a given product model and platform.”
The corporate advises directors to put in as we speak’s emergency safety patches (ColdFusion 2021 Replace 18 and ColdFusion 2023 Replace 12) as quickly as attainable, “for instance, inside 72 hours,” and apply safety configuration settings outlined within the ColdFusion 2023 and ColdFusion 2021 lockdown guides.
Whereas Adobe has but to reveal if this vulnerability has been exploited within the wild, it suggested prospects as we speak to assessment its up to date serial filter documentation for extra data on blocking insecure Wddx deserialization assaults.
As CISA warned in Could when it urged software program firms to weed out path traversal safety bugs earlier than delivery their merchandise, attackers can exploit such vulnerabilities to entry delicate knowledge, together with credentials that can be utilized to brute-force already current accounts and breach a goal’s techniques.
“Vulnerabilities like listing traversal have been referred to as ‘unforgivable’ since a minimum of 2007. Regardless of this discovering, listing traversal vulnerabilities (resembling CWE-22 and CWE-23) are nonetheless prevalent courses of vulnerability,” CISA stated.
Final 12 months, in July 2023, CISA additionally ordered federal businesses to safe their Adobe ColdFusion servers by August tenth in opposition to two important safety flaws (CVE-2023-29298 and CVE-2023-38205) exploited in assaults, one in every of them as a zero-day.
The U.S. cybersecurity company additionally revealed one 12 months in the past that hackers had been utilizing one other important ColdFusion vulnerability (CVE-2023-26360) to breach outdated authorities servers since June 2023. The identical flaw had been actively exploited in “very restricted assaults” as a zero-day since March 2023.
