Announcing CF update released Jul 14 2023: a second priority 1 security update in one week
For more on the update, and some additional thoughts, read on.
For more on the update, and some additional thoughts, read on.
Announcing Java updates of Jul 15, 2025 for 8, 11, 17, 21, and 24: thoughts and resources
Announcing ColdFusion updates released July 8 2025: p1 security update and more
Presenting "Debugging & Error Handling in ColdFusion" today, online for CF DevWeek
Announcing ColdFusion updates released May 13 2025: p1 security update (and more)
Presenting "Solving Common Problems with CF Updates" today, online
Announcing ColdFusion updates released July 8 2025: p1 security update and more
Marlon said:
Thanks for the detailed review of this (and previous) updates Charlie! Everything we
...
[more]
Announcing ColdFusion updates released July 8 2025: p1 security update and more
Charlie Arehart said:
Understood :-)
...
I've already updated the post about the new &qu
...
[more]
Announcing ColdFusion updates released July 8 2025: p1 security update and more
Tony Mason said:
Sorry about that, it's always the game of "maybe I should only paste the first part"
...
[more]
Announcing ColdFusion updates released July 8 2025: p1 security update and more
Tony Mason said:
Thanks Charlie! I didn't see anything in the known issues for 2023 list, but I should hav
...
[more]
Announcing ColdFusion updates released July 8 2025: p1 security update and more
Charlie Arehart said:
I'm also going to dramatically pare down the several dozen lines of error details your comment,
...
[more]
I will note that while that post indicates that "There is currently no mitigation", that may not be the final/complete answer. Note how it refers to the _cfclient querystring, and notice that in my first post last week (on the Jul 11 CF update), I did point out how my March blog post on the previous CF update discussed ways to BLOCK ALL REQUESTS using that _cfclient querystring. I also elaborate there on what it's about, how one can determine if they may have any legit use of it (most do not), and much more. See https://www.carehart...
As I've said elsewhere, it's just not clear how many of the recently closed vulns DO work based on the _cfclient querystring. That post is about all we have to go on, as I've not seen any others. While those on cf2018 and above can apply these fixes to address what Adobe has found, it's just not clear (for now) what those on cf2016 can or should do, other than block requests with that querystring.