Update to Adobe ColdFusion 2018 Update 5 or ColdFusion 2016 Update 12.Adobe ColdFusion 10 Standard Edition is another powerful program from Adobe Systems. Successful exploitation will allows an attackers to execute arbitrary code and leak sensitive information. Adobe ColdFusion 2016 Update 11 and earlier versions.Adobe ColdFusion 2018 Update 4 and earlier versions.Adobe recommends updating the ColdFusion JDK/JRE to the latest version. It is also important to note that the server continues to be vulnerable when this update is installed without a corresponding JDK. However, there are no known instances of exploitation of these vulnerabilities by malwares or threat groups.Īdobe has released updates to fix these vulnerabilities. The other information disclosure vulnerability CVE-2019-8072 is rated important and allows an attacker to bypass security restrictions. In some cases, it is also possible for an attacker to take complete control of the server. The critical vulnerabilities ( CVE-2019-8073 and CVE-2019-8074) allow an attacker to execute arbitrary code and bypass access controls. CVE-2019-8074 : A path traversal vulnerability which allows an attacker to bypass access controls.CVE-2019-8073 : An arbitrary code execution vulnerability which can be triggered using command injection via a vulnerable component.CVE-2019-8072 : An information disclosure vulnerability which allows an attacker to bypass security restrictions.Adobe ColdFusion is a rapid development platform used for building modern web applications.Īs per the advisory, the vulnerabilities are outlined as follows: Two vulnerabilities are rated critical for arbitrary code execution and one is rated important for i nformation disclosure. Adobe released security updates for three vulnerabilities in ColdFusion.

Adobe coldfusion blog