Pete FreitagHotfix for CF8 FCKeditor Vulnerability Released
July 08, 2009
Adobe has just released a security hotfix for the FCKeditor vulnerability in Coldfusion 8.
Also of Note, Adobe's Terry Ryan posted a blog entry today detailing How to report a ColdFusion Security Issue to Adobe.
Tweet
You might also like:
- ColdFusion 8 FCKeditor Vulnerability - July 3, 2009
- Risks of FCKeditor Vulnerability in CF8 - July 6, 2009
- FCKeditor Access Denied - October 15, 2009
- ColdFusion Security Hotfixes Released - August 18, 2009
- Tips for Secure File Uploads with ColdFusion - June 24, 2009
- Fixinator and Foundeo Security Bundle - May 14, 2019
- CFSummit 2016 Slides - October 17, 2016
- Scope Injection in CFML - March 3, 2015
Comments
Just a head's up to anyone applying this one:
1) The .jar file comes down as a .zip file. Just change the extension
2) I downloaded this one locally, uploaded to the server, and then copied over into the CFIDE folder. After that, I got a server login bix whenever I tried to use cftextarea.
Turns out the cftextarea.js file had the FTP folder priviliages, and it required more privliages to work in the CFIDE folder. Once I set them up to match the other folder in that directory, it was fine again.
1) The .jar file comes down as a .zip file. Just change the extension
2) I downloaded this one locally, uploaded to the server, and then copied over into the CFIDE folder. After that, I got a server login bix whenever I tried to use cftextarea.
Turns out the cftextarea.js file had the FTP folder priviliages, and it required more privliages to work in the CFIDE folder. Once I set them up to match the other folder in that directory, it was fine again.
Hey, subtle must be your mildde name. Great post!
