CVE-2025-30281

Published Apr 8, 2025

Last updated 4 days ago

Adobe ColdFusion

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-30281 is an Improper Access Control vulnerability affecting Adobe ColdFusion versions 2023.12, 2021.18, 2025.0, and earlier. It allows an attacker to read arbitrary files from the file system, potentially accessing or modifying sensitive data without proper authorization. Exploitation of this vulnerability does not require any user interaction. The vulnerability stems from the product not restricting or incorrectly restricting access to a resource from an unauthorized actor. An attacker with high privileges can exploit this vulnerability to compromise the confidentiality and integrity of the system. It is recommended to upgrade to the latest version of Adobe ColdFusion beyond the affected versions and implement strict access controls.

Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction.
Source: psirt@adobe.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.1
Impact score: 6
Exploitability score: 2.3
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@adobe.com: CWE-284

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References