LoginSignup
0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 5 years have passed since last update.

@shimizukawasaki(清水 川崎)

[漏洞通告]CVE-2020-3761/CVE-2020-3794/Adobe ColdFusion 任意文件读取和任意文件包含

Posted at

漏洞描述

2020年3月18日,Adobe官方发布针对Adobe Coldfusion的安全更新补丁,编号为APSB20-16.该漏洞同样为之前tomcat爆出过漏洞的AJP协议导致.

漏洞编号

CVE-2020-3761
CVE-2020-3794

漏洞威胁等级

高危

影响范围

ColdFusion 2016 Update13及之前版本
ColdFusion 2018 Update7及之前版本

漏洞验证

使用之前自研的AJP利用工具验证即可

文件读取验证

image.png

文件包含验证
image.png

修复建议

升级最新补丁APSB20-16

时间轴

[0] 2020/03/03 Adobe官方确认漏洞存在并开始着手修复；
[1] 2020/03/18 Adobe官方发布安全补丁。
[2] 2020/03/20 亚信安全网络攻防实验室分析&复现该漏洞并发布漏洞通告

Reference

0
0
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?