Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Application Security

Adobe Patches Critical ColdFusion Security Flaw

Adobe has released an urgent patch for a potentially dangerous security vulnerability in Adobe ColdFusion, the platform used for building and deploying mobile and web apps.

Adobe has released an urgent patch for a potentially dangerous security vulnerability in Adobe ColdFusion, the platform used for building and deploying mobile and web apps.

“These updates resolve a critical vulnerability that could lead to arbitrary code execution,” Adobe said in an advisory issued on Monday. 

The security updates are available for ColdFusion versions 2021 (including version 2021.0.0.323925), 2016 and 2018.

Adobe said it has not observed signs of in-the-wild exploitation targeting the new CVE-2021-20187 vulnerability.  

According to Adobe’s advisory, the vulnerability is described as “improper input validation” that could lead to arbitrary remote code execution.

The company recommends that users update the ColdFusion JDK/JRE to the latest version of the LTS releases for 1.8 and JDK 11.  “Applying the ColdFusion update without a corresponding JDK update will NOT secure the server,” Adobe warned.

The company also published security configuration settings and lockdown guides for ColdFusion deployments.

Related: Adobe Patches Critical Flaws in AEM, FrameMaker, InDesign

Related: Adobe Patches 11 Critical Vulnerabilities in Acrobat and Reader

Written By

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.