PT-2025-15658 · Adobe · Coldfusion

Publicado 2025-04-08 · Atualizado 2025-04-23 · CVE-2025-30289

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.0 and earlier ColdFusion versions 2023.12 ColdFusion versions 2021.18

Description: The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as OS Command Injection, which could lead to arbitrary code execution by an attacker. This exploitation does not require user interaction.

Recommendations: For ColdFusion version 2025.0 and earlier, update to a version that addresses the OS Command Injection issue. For ColdFusion version 2023.12, apply the necessary patch or update to resolve the vulnerability. For ColdFusion version 2021.18, consider applying configuration changes or workarounds to mitigate the risk of OS Command Injection until a patch is available.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2025-04069

CVE-2025-30289

Produtos afetados

Coldfusion

Referências · 9

• https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html · Aviso do Fabricante
• https://t.me/cvetracker/21180 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2025-04069 · Nota de Segurança
• https://t.me/cvenotify/119595 · Publicação no Telegram
• https://t.me/cvedetector/22523 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1909906914734915659 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-30289 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-30289 · Nota de Segurança
• https://twitter.com/cybercronai/status/1910018785680990510 · Publicação no Twitter