Adobe has launched out-of-band safety updates to handle a essential ColdFusion vulnerability with proof-of-concept (PoC) exploit code.
In an advisory launched on Monday, the corporate says the flaw (tracked as CVE-2024-53961) is brought on by a path traversal weak spot that impacts Adobe ColdFusion variations 2023 and 2021 and may allow attackers to learn arbitrary recordsdata on susceptible servers.
“Adobe is conscious that CVE-2024-53961 has a recognized proof-of-concept that might trigger an arbitrary file system learn,” Adobe stated at the moment, whereas additionally cautioning clients that it assigned a “Precedence 1” severity ranking to the flaw as a result of it has a “a better danger of being focused, by exploit(s) within the wild for a given product model and platform.”
The corporate advises directors to put in at the moment’s emergency safety patches (ColdFusion 2021 Replace 18 and ColdFusion 2023 Replace 12) as quickly as attainable, “for instance, inside 72 hours,” and apply safety configuration settings outlined within the ColdFusion 2023 and ColdFusion 2021 lockdown guides.
Whereas Adobe has but to reveal if this vulnerability has been exploited within the wild, it suggested clients at the moment to overview its up to date serial filter documentation for extra info on blocking insecure Wddx deserialization assaults.
As CISA warned in Might when it urged software program corporations to weed out path traversal safety bugs earlier than transport their merchandise, attackers can exploit such vulnerabilities to entry delicate information, together with credentials that can be utilized to brute-force already present accounts and breach a goal’s methods.
“Vulnerabilities like listing traversal have been referred to as ‘unforgivable’ since at the very least 2007. Regardless of this discovering, listing traversal vulnerabilities (corresponding to CWE-22 and CWE-23) are nonetheless prevalent lessons of vulnerability,” CISA stated.
Final yr, in July 2023, CISA additionally ordered federal businesses to safe their Adobe ColdFusion servers by August tenth in opposition to two essential safety flaws (CVE-2023-29298 and CVE-2023-38205) exploited in assaults, one in all them as a zero-day.
The U.S. cybersecurity company additionally revealed one yr in the past that hackers had been utilizing one other essential ColdFusion vulnerability (CVE-2023-26360) to breach outdated authorities servers since June 2023. The identical flaw had been actively exploited in “very restricted assaults” as a zero-day since March 2023.