Skip to content
OpenAdvisories
High NCSC-2025-0387 12 CVEs

Kwetsbaarheden verholpen in Adobe ColdFusion

Published Dec 10, 2025 · Updated Dec 10, 2025 · nl

Vendor: Adobe Product: ColdFusion Product: ColdFusion 2023 Product: ColdFusion 2025 Product: coldfusion_2021

Summary

Adobe heeft kwetsbaarheden verholpen in ColdFusion (Specifiek voor versies 25.4, 23.16, 21.22 en eerder).

Details

Interpretaties
De kwetsbaarheden bevinden zich in de manier waarop ColdFusion omgaat met bestandsuploads, invoervalidatie, en toegang tot gegevens. Gebruikers met hoge rechten kunnen ongeoorloofde code uitvoeren of toegang krijgen tot gevoelige gegevens zonder gebruikersinteractie. Dit kan leiden tot ernstige beveiligingsinbreuken en compromittering van de integriteit van de systemen.

Oplossingen
Adobe heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 12

  • Critical 9.1
    CVE-2025-61808 EPSS 11%

    ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could lead to arbitrary code execution by a high priviledged attacker. Exploitation of this issue does not require u…

    Adobe ColdFusion
  • Critical 9.1
    CVE-2025-61809

    ColdFusion | Improper Input Validation (CWE-20)

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized…

    Adobe ColdFusion
  • Critical 9.1
    CVE-2025-61811

    ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could leverage this vulnerability to…

    Adobe ColdFusion
  • High 8.4
    CVE-2025-61810 EPSS 10%

    ColdFusion | Deserialization of Untrusted Data (CWE-502)

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could exploit this vulnerab…

    Adobe ColdFusion
  • High 8.4
    CVE-2025-61812

    ColdFusion | Improper Input Validation (CWE-20)

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could allow a high privileged attacker to gain arbitrary code execution. Exploitation of this issue does not require user interaction.

    Adobe ColdFusion
  • High 7.4
    CVE-2025-61813

    ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensi…

    Adobe ColdFusion
  • High 7.1
    CVE-2025-61830

    Adobe Pass | Incorrect Authorization (CWE-863)

    Adobe Pass versions 3.7.3 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue requires user int…

    Adobe Adobe Pass
  • Medium 6.8
    CVE-2025-61821

    ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensi…

    Adobe ColdFusion
  • Medium 6.2
    CVE-2025-61822

    ColdFusion | Improper Input Validation (CWE-20)

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write. An attacker could exploit this vulnerability to write malicious files to arbitrary locations on…

    Adobe ColdFusion
  • Medium 6.2
    CVE-2025-61823

    ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A high privileged attacker could exploit this vulnerability …

    Adobe ColdFusion
  • Medium 5.6
    CVE-2025-64897

    ColdFusion | Improper Access Control (CWE-284)

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability. A low privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access potentially r…

    Adobe ColdFusion
  • Medium 5.3
    CVE-2025-64898

    ColdFusion | Insufficiently Protected Credentials (CWE-522)

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could result in limited unauthorized write access. An attacker could leverage this vulnerability to gain unauthorized access by…

    Adobe ColdFusion

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html