helpx.adobe.com
Open in
urlscan Pro
2a02:26f0:3500:11::215:14d6
Public Scan
URL:
https://helpx.adobe.com/security/products/coldfusion/apsb24-41.html
Submission: On June 24 via api from IN — Scanned from DE
Submission: On June 24 via api from IN — Scanned from DE
Form analysis 0 forms found in the DOM
Text Content
* * * * Adobe
*
* * * Creativity & Design Creativity Creativity & Design
* * * * What is Creative Cloud? Creative apps and services
for everyone
* * Photographers Lightroom, Photoshop, and more
* Students and teachers Save over 60% on Creative
Cloud
* Individuals 20+ creative apps, Acrobat, and more
* Business Solutions for teams and enterprises
* Schools and universities Simple administration and
licensing
* View plans and pricing Simple administration and
licesing
* Featured products
* Photoshop Image editing and design
* Adobe Express All-in-one design, video, photo, and
PDF app
* Lightroom Photo editing and organization
* Illustrator Vector graphics and illustration
* Premiere Pro Video editing and production
* Adobe Stock High-quality licensable assets
* View all products
* * Explore
* Photo
* Graphic design
* Video
* Illustration
* Social media
* 3D & AR
* PDF
* Artificial Intelligence
* AI Overview About AI at Adobe
* Adobe Firefly AI-powered content creation
* * *
* * Find the perfect app in about 60 seconds.
* Get started
* * Adobe.com
* Creativity & Design
* PDF & E-signatures
* Marketing & Commerce
* Help & Support
*
* * Adobe Creative Cloud
* Explore
* Photo
* Graphic Design
* Video
* Illustration
* Social Media
* What's new
* For Business
* Compare plans
* Learn & Support Support Learn & Support
* Home
* Get started
* Tutorials
* User Guide
* Contact Us
* * Free trial
* Buy now
* Adobe
* *
* App switcher
Sign in
*
*
ADOBE SECURITY BULLETIN
Search
Last updated on Jun 11, 2024
Security updates available for Adobe ColdFusion | APSB24-41
Bulletin ID
Date Published
Priority
APSB24-41
June 11, 2024
3
SUMMARY
Adobe has released security updates for ColdFusion versions 2023 and 2021. These
updates resolve important vulnerabilities that could lead to arbitrary file
system read and security feature bypass.
AFFECTED VERSIONS
Product
Update number
Platform
ColdFusion 2023
Update 7 and earlier versions
All
ColdFusion 2021
Update 13 and earlier versions
All
SOLUTION
Adobe categorizes these updates with the following priority rating and
recommends users update their installations to the newest versions:
Product
Updated Version
Platform
Priority rating
Availability
ColdFusion 2023
Update 8
All
3
Tech Note
ColdFusion 2021
Update 14
All
3
Tech Note
Note:
See the updated serial filter documentation for more details on protection
against insecure Wddx deserialization attacks
https://helpx.adobe.com/coldfusion/kb/coldfusion-serialfilter-file.html
VULNERABILITY DETAILS
Vulnerability Category
Vulnerability Impact
Severity
CVSS base score
CVSS vector
CVE Numbers
Improper Access Control (CWE-284)
Arbitrary file system read
Important
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2024-34112
Weak Cryptography for Passwords (CWE-261)
Security feature bypass
Important
6.2
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2024-34113
ACKNOWLEDGEMENTS:
Adobe would like to thank the following researchers for reporting this issue and
for working with Adobe to help protect our customers:
* Brian (reillyb) - CVE-2024-34112
* Ian Hickey (ionatomic) - CVE-2024-34113
NOTE: Adobe has a private, invite-only, bug bounty program with HackerOne. If
you are interested in working with Adobe as an external security researcher,
please fill out this form for next steps.
Note:
Adobe recommends updating your ColdFusion JDK/JRE LTS version to the latest
update release as a secure practice. The ColdFusion downloads page is regularly
updated to include the latest Java installers for the JDK version your
installation supports as per the matrices below.
* ColdFusion 2023 support matrix
* ColdFusion 2021 support matrix
For instructions on how to use an external JDK, view Change ColdFusion JVM.
Adobe also recommends applying the security configuration settings included
in the ColdFusion Security documentation as well as review the respective
Lockdown guides.
* ColdFusion 2023 Lockdown Guide
* ColdFusion 2021 Lockdown Guide
COLDFUSION JDK REQUIREMENT
COLDFUSION 2023 (version 2023.0.0.330468) and above
For Application Servers
On JEE installations, set the following JVM flag, “-Djdk.serialFilter=
!org.mozilla.**;!com.sun.syndication.**;!org.apache.commons.beanutils.**;!org.jgroups.**;!com.sun.rowset.**" in
the respective startup file depending on the type of Application Server being
used.
For example:
Apache Tomcat Application Server: edit JAVA_OPTS in the ‘Catalina.bat/sh’ file
WebLogic Application Server: edit JAVA_OPTIONS in the ‘startWeblogic.cmd’ file
WildFly/EAP Application Server: edit JAVA_OPTS in the ‘standalone.conf’ file
Set the JVM flags on a JEE installation of ColdFusion, not on a standalone
installation.
COLDFUSION 2021 (version 2021.0.0.323925) and above
For Application Servers
On JEE installations, set the following JVM flag, “-Djdk.serialFilter=
!org.mozilla.**;!com.sun.syndication.**;!org.apache.commons.beanutils.**;!org.jgroups.**;!com.sun.rowset.**"
in the respective startup file depending on the type of Application Server being
used.
For example:
Apache Tomcat Application Server: edit JAVA_OPTS in the ‘Catalina.bat/sh’
file
WebLogic Application Server: edit JAVA_OPTIONS in the ‘startWeblogic.cmd’
file
WildFly/EAP Application Server: edit JAVA_OPTS in the ‘standalone.conf’ file
Set the JVM flags on a JEE installation of ColdFusion, not on a standalone
installation.
--------------------------------------------------------------------------------
For more information, visit https://helpx.adobe.com/security.html , or email
PSIRT@adobe.com
Adobe
GET HELP FASTER AND EASIER
Sign in
New user?
Create an account
Manage account
Quick links
View all your plans Manage your plans
View quick links
Hide quick links
Adobe MAX
The Creativity Conference
Oct 14–16 Miami Beach and online
Register Now
Adobe MAX
The Creativity Conference
Oct 14–16 Miami Beach and online
Register Now
Adobe MAX
The Creativity Conference
Oct 14–16 Miami Beach and online
Register Now
Adobe MAX
The Creativity Conference
Oct 14–16 Miami Beach and online
Register Now
Legal Notices | Online Privacy Policy
Share this page
*
*
*
* Link copied
Was this page helpful?
Yes, thanks
Not really
ASK THE COMMUNITY
Post questions and get answers from experts.
Ask now
CONTACT US
Real help from real people.
Start now
^ Back to top
* * * Shop for
* Creative Cloud
* Photoshop
* Adobe Express
* Photography
* Premiere Pro
* Adobe Stock
* Elements Family
* Document Cloud
* Acrobat
* Acrobat Sign
* Special offers
* View plans and pricing
* View all products
* * * For business
* Creative Cloud for business
* Creative Cloud for enterprise
* Acrobat for business
* * For education
* Discounts for students and teachers
* Schools and universities
* Digital Learning Solutions
* * For mobile
* Apps for iOS
* Apps for Android
* * Experience Cloud
* What is Experience Cloud?
* Analytics
* Experience Manager
* Commerce
* Marketo Engage
* Workfront
* Terms of Use
* * * Support
* Download and install
* Help Center
* Adobe Support Community
* Enterprise Support
* Genuine software
* * Resources
* Adobe Blog
* Adobe Developer
* * Adobe Account
* Log in to your account
* * Adobe
* About
* AI Overview
* Careers
* Newsroom
* Corporate responsibility
* Investor Relations
* Supply chain
* Trust Center
* Events
* Diversity and inclusion
* Integrity
* * Featured products
* Adobe Acrobat Reader
* Adobe Express
* Photoshop
* Illustrator
* * * Change region
* *
*
*
*
* Copyright © 2024 Adobe. All rights reserved.
* Privacy
* Terms of Use
* Cookie preferences
* Do not sell or share my personal information
* AdChoices
Language Navigation
Language Navigation
Choose a region
Selecting a region changes the language and/or content on Adobe.com.
* Americas
* Brasil
* Canada - English
* Canada - Français
* Latinoamérica
* México
* Argentina
* Colombia
* Perú
* Chile
* United States
* Asia Pacific
* Australia
* Hong Kong S.A.R. of China
* India - English
* Indonesia - English
* Malaysia - English
* New Zealand
* Philippines - English
* Vietnam - English
* 中国
* 中國香港特別行政區
* 台灣地區
* 日本
* Indonesia
* Malaysia
* Pilipinas
* Việt Nam
* भारत
* 한국
* Singapore
* Thailand - English
* ประเทศไทย
* Europe, Middle East and Africa
* Africa - English
* België - Nederlands
* Belgique - Français
* Belgium - English
* Česká republika
* Danmark
* Deutschland
* Eesti
* España
* France
* Greece - English
* Ireland
* Israel - English
* Italia
* Latvija
* Lietuva
* Luxembourg - Deutsch
* Luxembourg - English
* Luxembourg - Français
* Magyarország
* Middle East and North Africa - English
* Nederland
* Norge
* Österreich
* Polska
* Portugal
* România
* Schweiz
* Slovenija
* Slovensko
* Suisse
* Suomi
* Svizzera
* Türkiye
* United Kingdom
* България
* Россия
* Україна
* الشرق الأوسط وشمال أفريقيا - اللغة العربية
* ישראל - עברית
* Sverige
* Saudi Arabia - English
* United Arab Emirates - English
* الإمارات العربية المتحدة
* المملكة العربية السعودية
Locale Modal
We have detected you are visiting a different region on adobe.com
Sie befinden sich außerhalb der USA? Auf der Adobe-Website für Ihre Region
finden Sie Informationen zu den für Sie relevanten Preisen, Angeboten und
Veranstaltungen.
Are you visiting adobe.com from outside your region? Visit your regional site
for more relevant pricing, promotions and events.
Zur Website für DeutschlandContinue to United States
MAKE IT YOUR OWN
Adobe and its vendors use cookies and similar technologies to improve your
experience and measure your interactions with our websites, products and
services. We also use them to provide you more relevant information in searches
and in ads on this and other sites. If that’s okay, click “Enable all". Clicking
“Don’t enable” will set only cookies that are strictly necessary. You can also
view our vendors and customize your choices by clicking "Cookie Settings".
Cookie Settings Don't Enable Enable all
COOKIE SETTINGS
Don’t enable Enable all Confirm my choices
GENERAL INFORMATION
* You are in control of your data.
You can control how Adobe websites use cookies and similar technologies by
making choices below. But note that if you disable cookies and similar
technologies entirely, Adobe websites may not function properly.
* What are cookies and why does Adobe use them?
Cookies are small text files stored by your web browser when you use
websites. There are also other technologies that can be used for similar
purposes like HTML5 Local Storage and local shared objects, web beacons, and
embedded scripts. These technologies help us do things like remembering you
and your preferences when you return to our sites, measure how you use the
website, conduct market research, and gather information about the ads you
see and interact with.
* How do I make choices?
You can make choices in the menu below about what cookies and other
technologies you want us to use on Adobe sites when you visit them from this
browser. You can always change those choices later by clicking on the Cookie
Preferences link at the bottom of the page.
IF ENABLED:
* We can improve your experience by tailoring the site and the content to
things we think might be of interest
* We can better keep track of your preferences — like what language you prefer
to use
* We will better understand your likely interests so we can provide you more
relevant Adobe ads and content on non-Adobe websites and in non-Adobe apps
* It will help us improve the performance of our website and those of our
partners who use the Adobe Experience Cloud
IF DISABLED:
* We won’t be able to remember you from session to session so the experience
may not be tailored to your interests
* You’ll still have access to the content of the site but certain features that
depend on cookies may not function
* You’ll still see ads, they just may not be as relevant to you
Enable all
OPERATE THE SITE AND CORE SERVICES
Always active
Operate the site and core services
These cookies are required, and they are used to enable the site and related
services core functionality. Without them the site could not operate, so they
cannot be disabled.
Cookie details
MEASURE PERFORMANCE
Measure performance
These cookies are used to analyze site usage to measure and improve performance.
Without them Adobe cannot know what content is most valued and how often unique
visitors return to the site, making it hard to improve information we offer to
you.
Cookie details
EXTEND FUNCTIONALITY
Extend functionality
These cookies are used to enhance the functionality of Adobe sites such as
remembering your settings and preferences to deliver a personalized experience;
for example, your username, your repeated visits, preferred language, your
country, or any other saved preference.
Cookie details
PERSONALIZE ADVERTISING
Personalize advertising
These cookies are used to enable Adobe and our partners to serve ads more
relevant to your interests. Without them you will still see ads, but they might
not be as relevant to you.
Cookie details
Confirm my choices
Back Button
Back
PERFORMANCE COOKIES
Vendor Search Search Icon Filter Icon
Clear Filters
Information storage and access
Apply
Consent Leg.Interest
All Consent Allowed
Select All Vendors
Select All Vendors
All Consent Allowed
Confirm my choices
Chat with us