If you have any information regarding this alert, please contact JPCERT/CC. Security Updates Available for ColdFusion (APSB19-14)

SolutionPlease update Adobe ColdFusion to the latest version listed below. Adobe ColdFusion 11 Update 17 and earlier Adobe ColdFusion 2016 Update 9 and earlier Adobe ColdFusion 2018 Update 2 and earlier vulnerabilities to initiate a shell session and then access the victims. Affected ProductsAffected products and versions are as follows: When clicking on administrator, I get a login window for Adobe ColdFusion 8 1:1. Security updates available for ColdFusion | APSB19-14 For more information, please refer to the Adobe website. The Alert was updated based on some feedback from the website visitors.Īccording to Adobe, they have received reports on attacks exploiting this vulnerability. (Update) An attacker may upload files to a server that runs ColdFusion with specific configurations by bypassing the file upload restrictions.If a file is uploaded to a web-accessible directory, an attacker may execute arbitrary code by opening the file remotely in the context of the current user of the ColdFusion. (Initial) An attacker leveraging the vulnerability may upload a file to a web-accessible directory avoiding restrictions on file upload.As a result, an attacker could execute arbitrary code in the context of the running ColdFusion service. This update is to add some details to about the conditions.

There are several conditions for the vulnerability to be exploited.

Adobe coldfusion 11 accessibility