- 343/2024
- High
Adobe has released a security update to fix a vulnerability in Adobe ColdFusion versions 2023.11 and 2021.17.
The addressed vulnerability could allow the remote attacker to access files or directories outside the restricted directory set by the application. This could lead to the disclosure of sensitive information or the manipulation of system data.
Adobe ColdFusion Path Traversal Vulnerability (CVE-2024-53961):
- CVSS: 7.4
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Consequences: Obtain Information
It should be highlighted that Adobe is aware that “CVE-2024-53961” has a known proof-of-concept that could cause an arbitrary file system read.
Vulnerabilities
CVE-2024-53961
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.