PT-2025-50291 · Adobe · Coldfusion

Published 2025-12-09 · Updated 2025-12-10 · CVE-2025-64898

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier

Description The software contains an issue with insufficiently protected credentials, potentially allowing limited unauthorized write access. An attacker could exploit improperly stored or transmitted credentials to gain unauthorized access without requiring user interaction.

Recommendations Update ColdFusion to a version later than 2025.4. Update ColdFusion to a version later than 2023.16. Update ColdFusion to a version later than 2021.22.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2025-15571

CVE-2025-64898

Affected Products

Coldfusion

References · 7

• https://bdu.fstec.ru/vul/2025-15571 · Security Note
• https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64898 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64898 · Security Note
• https://twitter.com/VulmonFeeds/status/1998674369459929338 · Twitter Post
• https://twitter.com/CVEnew/status/1998732765769162776 · Twitter Post
• https://t.me/CVEtracker/39320 · Telegram Post