PT-2025-15662 · Adobe · Coldfusion

Published 2025-04-08 · Updated 2025-04-09 · CVE-2025-30293

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.0 and earlier ColdFusion versions 2023.12 ColdFusion versions 2021.18

Description: The issue is related to an Improper Input Validation that could result in a security feature bypass. An attacker could leverage this to bypass security measures and gain unauthorized access. Exploitation requires user interaction, where a victim must open a malicious file.

Recommendations: For ColdFusion versions 2025.0 and earlier, update to a version that includes the security fix. For ColdFusion version 2023.12, apply the necessary security patch to resolve the issue. For ColdFusion version 2021.18, consider applying additional security measures to mitigate the risk of exploitation until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2025-04790

CVE-2025-30293

Affected Products

Coldfusion

References · 8

• https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-30293 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30293 · Security Note
• https://bdu.fstec.ru/vul/2025-04790 · Security Note
• https://t.me/cvedetector/22519 · Telegram Post
• https://t.me/cvetracker/21184 · Telegram Post
• https://twitter.com/CVEnew/status/1909906909693346168 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1909725030553895328 · Twitter Post