NOW LIVE! Adobe ColdFusion 2023 and 2021 March 2024 security updates

It's very important that people read the technote before "just applying this update". There is a very important (and fundamental) change in how CFML processes variables, with regard to searching for scopes when no scope is indicated on a variable name (at least in many cases. See newer comments below.), as the update changes CF's default behavior for an application setting called searchimplicitscopes. That was introduced in CF2016, and it defaulted to true, but this update changes that to default to false.

This is almost certainly a BREAKING change in many CF apps--and it's a change Adobe has implemented for the sake of security, it seems. For more on that, see the technote. (Update: for more on what apps might break, see my later comments below.) 

At a minimum I want to call out that if you may have code that WOULD break (with the second two being for when you must favor compatibility over security), there are 3 available solutions to the problem. You can either:

• change your code (to scope variables as needed)
• change your application.cfc or cfm to enable searchimplicitscopes=TRUE
• change ALL CF processing by adding instead a JVM argument to CF's startup

  • -Dcoldfusion.searchimplicitscopes=true

These are discussed further in the technote. And note that this new JVM arg will NOT be supported in the next and future releases, so you will NOT be able to rely on that 3rd option beyond CF2023. You will instead need to consider either of the first two options.

(I'm just a messenger here. I have nothing to do with the change or how it was implemented. I just help people solve problems, and this is going to be one for many as they deal with it, and for a long time to come as they later a) apply this update, b) move to CF2021/23 and apply this update, or c) move from earlier cf versions to later ones.)

There's also much more to the update beyond this one issue, so again READ the update technote. Update: read also the many comments here as well as a blog post I did that night of the update (taking into consideration many of the comments and questions raised here).