Just to verify that argumentsCollection CVE that they are ta cfml #lucee

Just to verify -- that argumentsCollection CVE tha...

quetwo

01/19/2024, 3:40 PM

Just to verify -- that argumentsCollection CVE that they are talking about in the Adobe channel shouldn't impact Lucee users, right?

Brian Reilly

01/19/2024, 3:44 PM

correct. based on my testing, Lucee isn't impacted. Lucee and ACF differ in how they process argumentsCollection and manage scopes

Brian Reilly

01/19/2024, 3:46 PM

within a remote CFC method in Lucee, the requesting user can control the VARIABLES scope, but that's documented/by design.

quetwo

01/19/2024, 3:52 PM

Ok. that's what I was figuring, but wanted to verify. thanks!

3 Views