PT-2025-15658 · Adobe · Coldfusion

Published 2025-04-08 · Updated 2025-04-23 · CVE-2025-30289

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.0 and earlier ColdFusion versions 2023.12 ColdFusion versions 2021.18

Description: The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as OS Command Injection, which could lead to arbitrary code execution by an attacker. This exploitation does not require user interaction.

Recommendations: For ColdFusion version 2025.0 and earlier, update to a version that addresses the OS Command Injection issue. For ColdFusion version 2023.12, apply the necessary patch or update to resolve the vulnerability. For ColdFusion version 2021.18, consider applying configuration changes or workarounds to mitigate the risk of OS Command Injection until a patch is available.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-04069

CVE-2025-30289

Affected Products

Coldfusion

References · 9

• https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04069 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30289 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30289 · Security Note
• https://t.me/cvetracker/21180 · Telegram Post
• https://t.me/cvenotify/119595 · Telegram Post
• https://t.me/cvedetector/22523 · Telegram Post
• https://twitter.com/CVEnew/status/1909906914734915659 · Twitter Post
• https://twitter.com/cybercronai/status/1910018785680990510 · Twitter Post