ColdFusion Log4j Vul

ColdFusion 2016

Install Update 17 Manually

https://helpx.adobe.com/coldfusion/kb/coldfusion-2016-update-17.html

Install ColdFusion patches manually

If Error 403 occurs, need to upgrade wsconfig tool at {cf_install_home}/{instance_name}/runtime/bin:

1. Stop the entire IIS website

2. Open wsconfig as administrator

3. Click “Upgrade:

Open

You can also upgrade wsconfig on CMD: wsconfig -upgrade.

log4j-1.2.15 (check the log4j version at “\cfusion\lib”)

zero-day exploit affecting the popular Apache Log4j utility (CVE-2021-44228)

Inside the Log4j2 vulnerability (CVE-2021-44228)