Skip to content
OpenAdvisories
High NCSC-2025-0162 8 CVEs

Kwetsbaarheden verholpen in Adobe ColdFusion

Published May 14, 2025 · Updated May 14, 2025 · nl

Vendor: Adobe Product: ColdFusion 2023 Product: ColdFusion 2025 Product: coldfusion_2021

Summary

Adobe heeft kwetsbaarheden verholpen in ColdFusion (Versies 2025.1, 2023.13, 2021.19 en eerder).

Details

Interpretaties
De kwetsbaarheden bevinden zich in de wijze waarop ColdFusion omgaat met invoervalidatie en autorisatie. Hooggeprivilegieerde aanvallers kunnen willekeurige code uitvoeren zonder gebruikersinteractie, wat kan leiden tot ongeautoriseerde toegang en controle over de getroffen systemen. Daarnaast zijn er kwetsbaarheden die ongeautoriseerde toegang tot gevoelige gegevens mogelijk maken.

Oplossingen
Adobe heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 8

  • Critical 9.1
    CVE-2025-43559

    ColdFusion | Improper Input Validation (CWE-20)

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability …

    Adobe ColdFusion
  • Critical 9.1
    CVE-2025-43560 EPSS 23%

    ColdFusion | Improper Input Validation (CWE-20)

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability …

    Adobe ColdFusion
  • Critical 9.1
    CVE-2025-43561 EPSS 24%

    ColdFusion | Incorrect Authorization (CWE-863)

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to…

    Adobe ColdFusion
  • Critical 9.1
    CVE-2025-43562 EPSS 51%

    ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current us…

    Adobe ColdFusion
  • Critical 9.1
    CVE-2025-43563 EPSS 17%

    ColdFusion | Improper Access Control (CWE-284)

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data …

    Adobe ColdFusion
  • Critical 9.1
    CVE-2025-43564 Public exploit EPSS 17%

    ColdFusion | Incorrect Authorization (CWE-863)

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data …

    Adobe ColdFusion
  • High 8.4
    CVE-2025-43565 EPSS 18%

    ColdFusion | Incorrect Authorization (CWE-863)

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could lead to arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to b…

    Adobe ColdFusion
  • Medium 6.8
    CVE-2025-43566 EPSS 58%

    ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A high-privileged attacker could leverage t…

    Adobe ColdFusion

Revision history

  1. #1.0.0

    Initiele versie

References