Updates released by Adobe on Tuesday for its ColdFusion web application development platform address three vulnerabilities, including two that have been classified “critical.”
ColdFusion 2016 Update 12 and ColdFusion 2018 Update 5 fix a critical path traversal vulnerability that can be exploited to bypass access controls (CVE-2019-8074), and a critical command injection flaw that can be leveraged for arbitrary code execution (CVE-2019-8073).
The last security hole, described by Adobe as a security bypass that can lead to information disclosure, was assigned an “important” severity rating.
Researchers from Foundeo, Knownsec 404 Team and Aura Information Security have been credited by Adobe for reporting these vulnerabilities.
Adobe says it’s not aware of any attacks exploiting these weaknesses and the company believes they are unlikely to be exploited any time soon. However, users should not ignore the updates considering that threat actors have been known to exploit ColdFusion vulnerabilities in their attacks. At least two ColdFusion flaws have been exploited in the wild over the past year.
The Patch Tuesday updates released by Adobe this month addressed two arbitrary code execution vulnerabilities in Flash Player and a DLL hijacking issue in Application Manager.
Related: Adobe Fixes Low Priority Flaws With July 2019 Patch Tuesday Updates
Related: Adobe Patches 118 Vulnerabilities Across Eight Products
Related: Adobe Patches Over 80 Vulnerabilities in Acrobat Products
Related: Adobe Releases Second Patch for Data Leakage Flaw in Reader
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- UK Car Retailer Arnold Clark Hit by Ransomware
- EV Charging Management System Vulnerabilities Allow Disruption, Energy Theft
- Unpatched Econolite Traffic Controller Vulnerabilities Allow Remote Hacking
- Google Fi Data Breach Reportedly Led to SIM Swapping
- Microsoft’s Verified Publisher Status Abused in Email Theft Campaign
- British Retailer JD Sports Discloses Data Breach Affecting 10 Million Customers
- Meta Awards $27,000 Bounty for 2FA Bypass Vulnerability
- Industry Reactions to Hive Ransomware Takedown: Feedback Friday
Latest News
- Google Shells Out $600,000 for OSS-Fuzz Project Integrations
- F5 BIG-IP Vulnerability Can Lead to DoS, Code Execution
- Flaw in Cisco Industrial Appliances Allows Malicious Code to Persist Across Reboots
- UK Car Retailer Arnold Clark Hit by Ransomware
- Dealing With the Carcinization of Security
- HeadCrab Botnet Ensnares 1,200 Redis Servers for Cryptomining
- Cyber Insights 2023 | Supply Chain Security
- Cyber Insights 2023 | Regulations
