Adobe has launched out-of-band safety updates to handle a crucial ColdFusion vulnerability with proof-of-concept (PoC) exploit code.
In an advisory launched on Monday, the corporate says the flaw (tracked as CVE-2024-53961) is brought on by a path traversal weak spot that impacts Adobe ColdFusion variations 2023 and 2021 and may allow attackers to learn arbitrary information on susceptible servers.
“Adobe is conscious that CVE-2024-53961 has a recognized proof-of-concept that would trigger an arbitrary file system learn,” Adobe stated right now, whereas additionally cautioning clients that it assigned a “Precedence 1” severity score to the flaw as a result of it has a “a better danger of being focused, by exploit(s) within the wild for a given product model and platform.”
The corporate advises directors to put in right now’s emergency safety patches (ColdFusion 2021 Replace 18 and ColdFusion 2023 Replace 12) as quickly as potential, “for instance, inside 72 hours,” and apply safety configuration settings outlined within the ColdFusion 2023 and ColdFusion 2021 lockdown guides.
Whereas Adobe has but to reveal if this vulnerability has been exploited within the wild, it suggested clients right now to overview its up to date serial filter documentation for extra data on blocking insecure Wddx deserialization assaults.
As CISA warned in Might when it urged software program firms to weed out path traversal safety bugs earlier than delivery their merchandise, attackers can exploit such vulnerabilities to entry delicate information, together with credentials that can be utilized to brute-force already current accounts and breach a goal’s methods.
“Vulnerabilities like listing traversal have been known as ‘unforgivable’ since at the very least 2007. Regardless of this discovering, listing traversal vulnerabilities (equivalent to CWE-22 and CWE-23) are nonetheless prevalent courses of vulnerability,” CISA stated.
Final 12 months, in July 2023, CISA additionally ordered federal businesses to safe their Adobe ColdFusion servers by August tenth towards two crucial safety flaws (CVE-2023-29298 and CVE-2023-38205) exploited in assaults, one in every of them as a zero-day.
The U.S. cybersecurity company additionally revealed one 12 months in the past that hackers had been utilizing one other crucial ColdFusion vulnerability (CVE-2023-26360) to breach outdated authorities servers since June 2023. The identical flaw had been actively exploited in “very restricted assaults” as a zero-day since March 2023.
