Adobe has taken emergency action to release an out-of-cycle software patch for its ColdFusion software following the discovery that a previous patch was incomplete and actively being exploited by attackers.
The security flaw, identified as CVE-2023-29298, allowed unauthorized access to the ColdFusion Markup (CFM) and ColdFusion Component (CFC) endpoints, granting attackers administration access. Rapid7 was the first to disclose this vulnerability.
In response, Adobe has released new patches that address access control weaknesses. Specifically, CVE-2023-38204, which rates 9.8 on the CVSS scale, has not been exploited. However, CVE-2023-38205, with a rating of 7.8, has already been actively exploited in limited attacks against Adobe ColdFusion. Additionally, there is CVE-2023-38206, rated at 5.3.
Adobe acknowledged that CVE-2023-38205 had been exploited in the wild in limited attacks, prompting the immediate release of the patches. The security firm Rapid7 identified that the previous fix issued by Adobe on July 11 for CVE-2023-29298 was inadequate. A modified exploit easily bypassed the patch, leading to the urgent release of a new fix, assigned as CVE-2023-38205 on July 19.
Rapid7 has since confirmed that the updated patch is effective in preventing the exploit.
To protect users, Rapid7 has shared three IP addresses and two domains that serve as indicators of compromise related to these vulnerabilities. Users are urged to apply the patches promptly and remain vigilant against potential threats.
