Updates released by Adobe on Tuesday for its ColdFusion web application development platform address three vulnerabilities, including two that have been classified “critical.”
ColdFusion 2016 Update 12 and ColdFusion 2018 Update 5 fix a critical path traversal vulnerability that can be exploited to bypass access controls (CVE-2019-8074), and a critical command injection flaw that can be leveraged for arbitrary code execution (CVE-2019-8073).
The last security hole, described by Adobe as a security bypass that can lead to information disclosure, was assigned an “important” severity rating.
Researchers from Foundeo, Knownsec 404 Team and Aura Information Security have been credited by Adobe for reporting these vulnerabilities.
Adobe says it’s not aware of any attacks exploiting these weaknesses and the company believes they are unlikely to be exploited any time soon. However, users should not ignore the updates considering that threat actors have been known to exploit ColdFusion vulnerabilities in their attacks. At least two ColdFusion flaws have been exploited in the wild over the past year.
The Patch Tuesday updates released by Adobe this month addressed two arbitrary code execution vulnerabilities in Flash Player and a DLL hijacking issue in Application Manager.
Related: Adobe Fixes Low Priority Flaws With July 2019 Patch Tuesday Updates
Related: Adobe Patches 118 Vulnerabilities Across Eight Products
Related: Adobe Patches Over 80 Vulnerabilities in Acrobat Products
Related: Adobe Releases Second Patch for Data Leakage Flaw in Reader