Adobe has launched out-of-band safety updates to handle a crucial ColdFusion vulnerability with proof-of-concept (PoC) exploit code.
In an advisory launched on Monday, the corporate says the flaw (tracked as CVE-2024-53961) is attributable to a path traversal weak spot that impacts Adobe ColdFusion variations 2023 and 2021 and may allow attackers to learn arbitrary recordsdata on weak servers.
“Adobe is aware that CVE-2024-53961 has a known proof-of-concept that could cause an arbitrary file system read,” Adobe stated immediately, whereas additionally cautioning clients that it assigned a “Priority 1” severity ranking to the flaw as a result of it has a “a higher risk of being targeted, by exploit(s) in the wild for a given product version and platform.”
The corporate advises directors to put in immediately’s emergency safety patches (ColdFusion 2021 Replace 18 and ColdFusion 2023 Replace 12) as quickly as doable, “for example, within 72 hours,” and apply safety configuration settings outlined within the ColdFusion 2023 and ColdFusion 2021 lockdown guides.
Whereas Adobe has but to reveal if this vulnerability has been exploited within the wild, it suggested clients immediately to evaluation its up to date serial filter documentation for extra data on blocking insecure Wddx deserialization assaults.
As CISA warned in Might when it urged software program corporations to weed out path traversal safety bugs earlier than delivery their merchandise, attackers can exploit such vulnerabilities to entry delicate knowledge, together with credentials that can be utilized to brute-force already present accounts and breach a goal’s techniques.
“Vulnerabilities like directory traversal have been called ‘unforgivable’ since at least 2007. Despite this finding, directory traversal vulnerabilities (such as CWE-22 and CWE-23) are still prevalent classes of vulnerability,” CISA stated.
Final 12 months, in July 2023, CISA additionally ordered federal businesses to safe their Adobe ColdFusion servers by August tenth towards two crucial safety flaws (CVE-2023-29298 and CVE-2023-38205) exploited in assaults, considered one of them as a zero-day.
The U.S. cybersecurity company additionally revealed one 12 months in the past that hackers had been utilizing one other crucial ColdFusion vulnerability (CVE-2023-26360) to breach outdated authorities servers since June 2023. The identical flaw had been actively exploited in “very limited attacks” as a zero-day since March 2023.
