erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: July 11, 2023

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: ColdFusion CVE-2023-29300/38203: Exploited Pre-Auth RCE. Anyone with a ColdFusion 2018, 2021 or 2023 server, internal or internet-facing, that has not been updated since mid-2023, or a JEE deployment without Adobe's serial filter flag.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2023-29300, CVE-2023-38203

ColdFusion CVE-2023-29300/38203: Exploited Pre-Auth RCE

Fixed since July 2023, but any ColdFusion server still below 2018 Update 19, 2021 Update 9 or 2023 Update 3 is open to a public, pre-auth RCE that ransomware crews have used; find those servers, upgrade, and hunt for web shells.

Must act: Anyone with a ColdFusion 2018, 2021 or 2023 server, internal or internet-facing, that has not been updated since mid-2023, or a JEE deployment without Adobe's serial filter flag.

Can relax: Teams on a current ColdFusion 2025 or 2023 update with the matching JDK, which include these fixes, and organizations that do not run ColdFusion at all.

  1. Inventory every ColdFusion server and read its version in ColdFusion Administrator; the third number is the update level (2018.0.19.330149 is 2018 Update 19).
  2. Move to a current ColdFusion 2025 or 2023 update; treat 2023 Update 3, 2021 Update 9 and 2018 Update 19 as the bare minimum for this chain.
  3. Update the bundled JDK to the version in Adobe's support matrix; Adobe says the ColdFusion update alone will not secure the server.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.