CVE-2025-24447

Published Apr 8, 2025

Last updated 4 days ago

Adobe ColdFusion

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-24447 is a deserialization of untrusted data vulnerability affecting Adobe ColdFusion versions 2023.12, 2021.18, 2025.0, and earlier. This vulnerability could lead to arbitrary code execution within the context of the current user. Exploitation of CVE-2025-24447 requires user interaction, specifically a victim opening a malicious file. Adobe has released security updates to address this vulnerability in ColdFusion versions 2025, 2023, and 2021.

Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Source: psirt@adobe.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: CRITICAL

Weaknesses

psirt@adobe.com: CWE-502

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References