CVE-2025-24446

Published Apr 8, 2025

Last updated 4 days ago

Adobe ColdFusion

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-24446 is an Improper Input Validation vulnerability affecting Adobe ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier. Successful exploitation could lead to arbitrary code execution within the context of the current user. User interaction is required to exploit this vulnerability, as a victim must open a malicious file. The vulnerability exists due to improper input validation, potentially allowing attackers to execute arbitrary code on vulnerable ColdFusion instances. Adobe has released security updates for ColdFusion versions 2025, 2023, and 2021 to address this and other vulnerabilities. It is recommended to update to the latest version of ColdFusion to mitigate the risk.

Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Source: psirt@adobe.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.1
Impact score: 6
Exploitability score: 2.3
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@adobe.com: CWE-20

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References