Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2025-30281 (GCVE-0-2025-30281)
Vulnerability from cvelistv5 – Published: 2025-04-08 20:02 – Updated: 2025-06-24 17:56
VLAI?
EPSS
Title
ColdFusion | Improper Access Control (CWE-284)
Summary
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction, and scope is changed.
Severity ?
9.1 (Critical)
CWE
- CWE-284 - Improper Access Control (CWE-284)
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Adobe | ColdFusion |
Affected:
0 , ≤ 2025.0
(semver)
|
Date Public ?
2025-04-08 17:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-30281",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-08T20:28:38.428233Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T20:41:35.186Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "ColdFusion",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "2025.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2025-04-08T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction, and scope is changed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 9.1,
"environmentalSeverity": "CRITICAL",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "NETWORK",
"modifiedAvailabilityImpact": "HIGH",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "HIGH",
"modifiedPrivilegesRequired": "HIGH",
"modifiedScope": "CHANGED",
"modifiedUserInteraction": "NONE",
"privilegesRequired": "HIGH",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "CHANGED",
"temporalScore": 9.1,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control (CWE-284)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-24T17:56:30.686Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ColdFusion | Improper Access Control (CWE-284)"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2025-30281",
"datePublished": "2025-04-08T20:02:51.732Z",
"dateReserved": "2025-03-20T17:36:17.300Z",
"dateUpdated": "2025-06-24T17:56:30.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-30281",
"date": "2026-04-15",
"epss": "0.07301",
"percentile": "0.91689"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2025-30281\",\"sourceIdentifier\":\"psirt@adobe.com\",\"published\":\"2025-04-08T20:15:25.670\",\"lastModified\":\"2025-07-15T18:40:24.337\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction, and scope is changed.\"},{\"lang\":\"es\",\"value\":\"Las versiones 2023.12, 2021.18, 2025.0 y anteriores de ColdFusion se ven afectadas por una vulnerabilidad de control de acceso inadecuado que podr\u00eda provocar la lectura arbitraria del sistema de archivos. Un atacante podr\u00eda aprovechar esta vulnerabilidad para acceder o modificar datos confidenciales sin la debida autorizaci\u00f3n. Para explotar este problema no se requiere la interacci\u00f3n del usuario.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@adobe.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.3,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.3,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"psirt@adobe.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"7A94B406-C011-4673-8C2B-0DD94D46CC4C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*\",\"matchCriteriaId\":\"AFD05E3A-10F9-4C75-9710-BA46B66FF6E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1FC7D1D-6DD2-48B2-980F-B001B0F24473\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FA19E1D-61C2-4640-AF06-4BCFE750BDF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update12:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F331DEA-F3D0-4B13-AB1E-6FE39B2BB55D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update13:*:*:*:*:*:*\",\"matchCriteriaId\":\"63D5CF84-4B0D-48AE-95D6-262AEA2FFDE8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update14:*:*:*:*:*:*\",\"matchCriteriaId\":\"10616A3A-0C1C-474A-BD7D-A2A5BB870F74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update15:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7DA523E-1D9B-45FD-94D9-D4F9F2B9296B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update16:*:*:*:*:*:*\",\"matchCriteriaId\":\"151AFF8B-F05C-4D27-85FC-DF88E9C11BEA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update17:*:*:*:*:*:*\",\"matchCriteriaId\":\"53A0E245-2915-4DFF-AFB5-A12F5C435702\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update18:*:*:*:*:*:*\",\"matchCriteriaId\":\"C5653D18-7534-48A3-819F-9F049A418F99\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*\",\"matchCriteriaId\":\"D57C8681-AC68-47DF-A61E-B5C4B4A47663\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*\",\"matchCriteriaId\":\"75608383-B727-48D6-8FFA-D552A338A562\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*\",\"matchCriteriaId\":\"7773DB68-414A-4BA9-960F-52471A784379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B38B9E86-BCD5-4BCA-8FB7-EC55905184E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E7BAB80-8455-4570-A2A2-8F40469EE9CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F9D645A2-E02D-4E82-A2BD-0A7DE5B8FBCC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update8:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E22D701-B038-4795-AA32-A18BC93C2B6F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2021:update9:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAC4A0EC-C3FC-47D8-86CE-0E6A87A7F0B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"B02A37FE-5D31-4892-A3E6-156A8FE62D28\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0AA3D302-CFEE-4DFD-AB92-F53C87721BFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*\",\"matchCriteriaId\":\"645D1B5F-2DAB-4AB8-A465-AC37FF494F95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED6D8996-0770-4C9F-BEA5-87EA479D40A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*\",\"matchCriteriaId\":\"4836086E-3D4A-4A07-A372-382D385CB490\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB88D4FE-5496-4639-BAF2-9F29F24ABF29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*\",\"matchCriteriaId\":\"43E0ED98-2C1F-40B8-AF60-FEB1D85619C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*\",\"matchCriteriaId\":\"76204873-C6E0-4202-8A03-0773270F1802\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3A83642-BF14-4C37-BD94-FA76AABE8ADC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*\",\"matchCriteriaId\":\"A892E1DC-F2C8-4F53-8580-A2D1BEED5A25\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB97ADBA-C1A9-4EE0-9509-68CB12358AE5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*\",\"matchCriteriaId\":\"E17C38F0-9B0F-4433-9CBD-6E3D63EA9BDC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"30779417-D4E5-4A01-BE0E-1CE1D134292A\"}]}]}],\"references\":[{\"url\":\"https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-30281\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-08T20:28:38.428233Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-08T20:33:03.160Z\"}}], \"cna\": {\"title\": \"ColdFusion | Improper Access Control (CWE-284)\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"modifiedScope\": \"CHANGED\", \"temporalScore\": 9.1, \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"remediationLevel\": \"NOT_DEFINED\", \"reportConfidence\": \"NOT_DEFINED\", \"temporalSeverity\": \"CRITICAL\", \"availabilityImpact\": \"HIGH\", \"environmentalScore\": 9.1, \"privilegesRequired\": \"HIGH\", \"exploitCodeMaturity\": \"NOT_DEFINED\", \"integrityRequirement\": \"NOT_DEFINED\", \"modifiedAttackVector\": \"NETWORK\", \"confidentialityImpact\": \"HIGH\", \"environmentalSeverity\": \"CRITICAL\", \"availabilityRequirement\": \"NOT_DEFINED\", \"modifiedIntegrityImpact\": \"HIGH\", \"modifiedUserInteraction\": \"NONE\", \"modifiedAttackComplexity\": \"LOW\", \"confidentialityRequirement\": \"NOT_DEFINED\", \"modifiedAvailabilityImpact\": \"HIGH\", \"modifiedPrivilegesRequired\": \"HIGH\", \"modifiedConfidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Adobe\", \"product\": \"ColdFusion\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2025.0\"}], \"defaultStatus\": \"affected\"}], \"datePublic\": \"2025-04-08T17:00:00.000Z\", \"references\": [{\"url\": \"https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction, and scope is changed.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-284\", \"description\": \"Improper Access Control (CWE-284)\"}]}], \"providerMetadata\": {\"orgId\": \"078d4453-3bcd-4900-85e6-15281da43538\", \"shortName\": \"adobe\", \"dateUpdated\": \"2025-06-24T17:56:30.686Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-30281\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-06-24T17:56:30.686Z\", \"dateReserved\": \"2025-03-20T17:36:17.300Z\", \"assignerOrgId\": \"078d4453-3bcd-4900-85e6-15281da43538\", \"datePublished\": \"2025-04-08T20:02:51.732Z\", \"assignerShortName\": \"adobe\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
CERTFR-2025-AVI-0292
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Adobe. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Adobe | Commerce | Commerce B2B versions 1.5.x antérieures à 1.5.2 | ||
| Adobe | Magento | Magento Open Source versions 2.4.7.x antérieures à 2.4.7-p5 | ||
| Adobe | Magento | Magento Open Source versions 2.4.6.x antérieures à 2.4.6-p10 | ||
| Adobe | Commerce | Commerce B2B versions 1.3.5.x antérieures à 1.3.5-p10 | ||
| Adobe | Magento | Magento Open Source versions 2.4.5.x antérieures à 2.4.5-p12 | ||
| Adobe | Commerce | Commerce versions 2.4.7.x antérieures à 2.4.7-p5 | ||
| Adobe | ColdFusion | ColdFusion 2021 versions antérieures à Update 19 | ||
| Adobe | Commerce | Commerce B2B versions 1.3.4.x antérieures à 1.3.4-p12 | ||
| Adobe | Magento | Magento Open Source versions 2.4.4.x antérieures à 2.4.4-p13 | ||
| Adobe | Commerce | Commerce B2B versions 1.3.3.x antérieures à 1.3.3-p13 | ||
| Adobe | ColdFusion | ColdFusion 2023 versions antérieures à Update 13 | ||
| Adobe | Magento | Magento Open Source versions 2.4.8.x antérieures à 2.4.8 | ||
| Adobe | Commerce | Commerce versions 2.4.5.x antérieures à 2.4.5-p12 | ||
| Adobe | Commerce | Commerce versions 2.4.8.x antérieures à 2.4.8 | ||
| Adobe | Commerce | Commerce B2B versions 1.4.x antérieures à 1.4.2-p5 | ||
| Adobe | Commerce | Commerce versions 2.4.6.x antérieures à 2.4.6-p10 | ||
| Adobe | Commerce | Commerce versions 2.4.4.x antérieures à 2.4.4-p13 | ||
| Adobe | ColdFusion | ColdFusion 2025 versions antérieures à Update 1 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Commerce B2B versions 1.5.x ant\u00e9rieures \u00e0 1.5.2",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Magento Open Source versions 2.4.7.x ant\u00e9rieures \u00e0 2.4.7-p5",
"product": {
"name": "Magento",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Magento Open Source versions 2.4.6.x ant\u00e9rieures \u00e0 2.4.6-p10",
"product": {
"name": "Magento",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce B2B versions 1.3.5.x ant\u00e9rieures \u00e0 1.3.5-p10",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Magento Open Source versions 2.4.5.x ant\u00e9rieures \u00e0 2.4.5-p12",
"product": {
"name": "Magento",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce versions 2.4.7.x ant\u00e9rieures \u00e0 2.4.7-p5",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "ColdFusion 2021 versions ant\u00e9rieures \u00e0 Update 19",
"product": {
"name": "ColdFusion",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce B2B versions 1.3.4.x ant\u00e9rieures \u00e0 1.3.4-p12",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Magento Open Source versions 2.4.4.x ant\u00e9rieures \u00e0 2.4.4-p13",
"product": {
"name": "Magento",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce B2B versions 1.3.3.x ant\u00e9rieures \u00e0 1.3.3-p13",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "ColdFusion 2023 versions ant\u00e9rieures \u00e0 Update 13",
"product": {
"name": "ColdFusion",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Magento Open Source versions 2.4.8.x ant\u00e9rieures \u00e0 2.4.8",
"product": {
"name": "Magento",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce versions 2.4.5.x ant\u00e9rieures \u00e0 2.4.5-p12",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce versions 2.4.8.x ant\u00e9rieures \u00e0 2.4.8",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce B2B versions 1.4.x ant\u00e9rieures \u00e0 1.4.2-p5",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce versions 2.4.6.x ant\u00e9rieures \u00e0 2.4.6-p10",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce versions 2.4.4.x ant\u00e9rieures \u00e0 2.4.4-p13",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "ColdFusion 2025 versions ant\u00e9rieures \u00e0 Update 1",
"product": {
"name": "ColdFusion",
"vendor": {
"name": "Adobe",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-30285",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30285"
},
{
"name": "CVE-2025-30292",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30292"
},
{
"name": "CVE-2025-24446",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24446"
},
{
"name": "CVE-2025-30289",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30289"
},
{
"name": "CVE-2025-30282",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30282"
},
{
"name": "CVE-2025-24447",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24447"
},
{
"name": "CVE-2025-30284",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30284"
},
{
"name": "CVE-2025-30288",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30288"
},
{
"name": "CVE-2025-30287",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30287"
},
{
"name": "CVE-2025-27192",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27192"
},
{
"name": "CVE-2025-30294",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30294"
},
{
"name": "CVE-2025-30290",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30290"
},
{
"name": "CVE-2025-30293",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30293"
},
{
"name": "CVE-2025-27190",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27190"
},
{
"name": "CVE-2025-27189",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27189"
},
{
"name": "CVE-2025-30286",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30286"
},
{
"name": "CVE-2025-30291",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30291"
},
{
"name": "CVE-2025-27188",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27188"
},
{
"name": "CVE-2025-27191",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27191"
},
{
"name": "CVE-2025-30281",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30281"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0292",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-04-09T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Adobe. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Adobe",
"vendor_advisories": [
{
"published_at": "2025-04-08",
"title": "Bulletin de s\u00e9curit\u00e9 Adobe APSB25-26",
"url": "https://helpx.adobe.com/security/products/magento/apsb25-26.html"
},
{
"published_at": "2025-04-08",
"title": "Bulletin de s\u00e9curit\u00e9 Adobe APSB25-15",
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html"
}
]
}
CERTFR-2025-AVI-0292
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Adobe. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Adobe | Commerce | Commerce B2B versions 1.5.x antérieures à 1.5.2 | ||
| Adobe | Magento | Magento Open Source versions 2.4.7.x antérieures à 2.4.7-p5 | ||
| Adobe | Magento | Magento Open Source versions 2.4.6.x antérieures à 2.4.6-p10 | ||
| Adobe | Commerce | Commerce B2B versions 1.3.5.x antérieures à 1.3.5-p10 | ||
| Adobe | Magento | Magento Open Source versions 2.4.5.x antérieures à 2.4.5-p12 | ||
| Adobe | Commerce | Commerce versions 2.4.7.x antérieures à 2.4.7-p5 | ||
| Adobe | ColdFusion | ColdFusion 2021 versions antérieures à Update 19 | ||
| Adobe | Commerce | Commerce B2B versions 1.3.4.x antérieures à 1.3.4-p12 | ||
| Adobe | Magento | Magento Open Source versions 2.4.4.x antérieures à 2.4.4-p13 | ||
| Adobe | Commerce | Commerce B2B versions 1.3.3.x antérieures à 1.3.3-p13 | ||
| Adobe | ColdFusion | ColdFusion 2023 versions antérieures à Update 13 | ||
| Adobe | Magento | Magento Open Source versions 2.4.8.x antérieures à 2.4.8 | ||
| Adobe | Commerce | Commerce versions 2.4.5.x antérieures à 2.4.5-p12 | ||
| Adobe | Commerce | Commerce versions 2.4.8.x antérieures à 2.4.8 | ||
| Adobe | Commerce | Commerce B2B versions 1.4.x antérieures à 1.4.2-p5 | ||
| Adobe | Commerce | Commerce versions 2.4.6.x antérieures à 2.4.6-p10 | ||
| Adobe | Commerce | Commerce versions 2.4.4.x antérieures à 2.4.4-p13 | ||
| Adobe | ColdFusion | ColdFusion 2025 versions antérieures à Update 1 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Commerce B2B versions 1.5.x ant\u00e9rieures \u00e0 1.5.2",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Magento Open Source versions 2.4.7.x ant\u00e9rieures \u00e0 2.4.7-p5",
"product": {
"name": "Magento",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Magento Open Source versions 2.4.6.x ant\u00e9rieures \u00e0 2.4.6-p10",
"product": {
"name": "Magento",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce B2B versions 1.3.5.x ant\u00e9rieures \u00e0 1.3.5-p10",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Magento Open Source versions 2.4.5.x ant\u00e9rieures \u00e0 2.4.5-p12",
"product": {
"name": "Magento",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce versions 2.4.7.x ant\u00e9rieures \u00e0 2.4.7-p5",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "ColdFusion 2021 versions ant\u00e9rieures \u00e0 Update 19",
"product": {
"name": "ColdFusion",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce B2B versions 1.3.4.x ant\u00e9rieures \u00e0 1.3.4-p12",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Magento Open Source versions 2.4.4.x ant\u00e9rieures \u00e0 2.4.4-p13",
"product": {
"name": "Magento",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce B2B versions 1.3.3.x ant\u00e9rieures \u00e0 1.3.3-p13",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "ColdFusion 2023 versions ant\u00e9rieures \u00e0 Update 13",
"product": {
"name": "ColdFusion",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Magento Open Source versions 2.4.8.x ant\u00e9rieures \u00e0 2.4.8",
"product": {
"name": "Magento",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce versions 2.4.5.x ant\u00e9rieures \u00e0 2.4.5-p12",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce versions 2.4.8.x ant\u00e9rieures \u00e0 2.4.8",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce B2B versions 1.4.x ant\u00e9rieures \u00e0 1.4.2-p5",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce versions 2.4.6.x ant\u00e9rieures \u00e0 2.4.6-p10",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce versions 2.4.4.x ant\u00e9rieures \u00e0 2.4.4-p13",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "ColdFusion 2025 versions ant\u00e9rieures \u00e0 Update 1",
"product": {
"name": "ColdFusion",
"vendor": {
"name": "Adobe",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-30285",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30285"
},
{
"name": "CVE-2025-30292",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30292"
},
{
"name": "CVE-2025-24446",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24446"
},
{
"name": "CVE-2025-30289",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30289"
},
{
"name": "CVE-2025-30282",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30282"
},
{
"name": "CVE-2025-24447",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24447"
},
{
"name": "CVE-2025-30284",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30284"
},
{
"name": "CVE-2025-30288",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30288"
},
{
"name": "CVE-2025-30287",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30287"
},
{
"name": "CVE-2025-27192",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27192"
},
{
"name": "CVE-2025-30294",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30294"
},
{
"name": "CVE-2025-30290",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30290"
},
{
"name": "CVE-2025-30293",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30293"
},
{
"name": "CVE-2025-27190",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27190"
},
{
"name": "CVE-2025-27189",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27189"
},
{
"name": "CVE-2025-30286",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30286"
},
{
"name": "CVE-2025-30291",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30291"
},
{
"name": "CVE-2025-27188",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27188"
},
{
"name": "CVE-2025-27191",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27191"
},
{
"name": "CVE-2025-30281",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30281"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0292",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-04-09T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Adobe. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Adobe",
"vendor_advisories": [
{
"published_at": "2025-04-08",
"title": "Bulletin de s\u00e9curit\u00e9 Adobe APSB25-26",
"url": "https://helpx.adobe.com/security/products/magento/apsb25-26.html"
},
{
"published_at": "2025-04-08",
"title": "Bulletin de s\u00e9curit\u00e9 Adobe APSB25-15",
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html"
}
]
}
NCSC-2025-0115
Vulnerability from csaf_ncscnl - Published: 2025-04-09 08:08 - Updated: 2025-04-09 08:08Summary
Kwetsbaarheden verholpen in Adobe ColdFusion
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Adobe heeft kwetsbaarheden verholpen in ColdFusion (Specifiek voor versies 2023.12, 2021.18, 2025.0 en eerder).
Interpretaties: De kwetsbaarheden bevinden zich in de manier waarop ColdFusion omgaat met invoervalidatie, authenticatie, toegang en deserialisatie van onbetrouwbare gegevens. Kwaadwillenden kunnen deze kwetsbaarheden misbruiken om willekeurige code uit te voeren, ongeautoriseerde toegang te verkrijgen, en gevoelige gegevens te lezen of te wijzigen. De meeste kwetsbaarheden vereisen gebruikersinteractie, zoals het openen van een kwaadaardig bestand of het bezoeken van een gecompromitteerde URL.
Oplossingen: Adobe heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-20: Improper Input Validation
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-284: Improper Access Control
CWE-287: Improper Authentication
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-502: Deserialization of Untrusted Data
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
9.1 (Critical)
6.8 (Medium)
6.1 (Medium)
8.7 (High)
7.8 (High)
8.1 (High)
8.0 (High)
8.0 (High)
8.0 (High)
9.1 (Critical)
9.1 (Critical)
9.1 (Critical)
6.5 (Medium)
7.5 (High)
6.2 (Medium)
References
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Adobe heeft kwetsbaarheden verholpen in ColdFusion (Specifiek voor versies 2023.12, 2021.18, 2025.0 en eerder).",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden bevinden zich in de manier waarop ColdFusion omgaat met invoervalidatie, authenticatie, toegang en deserialisatie van onbetrouwbare gegevens. Kwaadwillenden kunnen deze kwetsbaarheden misbruiken om willekeurige code uit te voeren, ongeautoriseerde toegang te verkrijgen, en gevoelige gegevens te lezen of te wijzigen. De meeste kwetsbaarheden vereisen gebruikersinteractie, zoals het openen van een kwaadaardig bestand of het bezoeken van een gecompromitteerde URL. ",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Adobe heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "general",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
},
{
"category": "general",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "general",
"text": "Improper Access Control",
"title": "CWE-284"
},
{
"category": "general",
"text": "Improper Authentication",
"title": "CWE-287"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "general",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "general",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference - cveprojectv5; nvd",
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html"
}
],
"title": "Kwetsbaarheden verholpen in Adobe ColdFusion",
"tracking": {
"current_release_date": "2025-04-09T08:08:15.866613Z",
"generator": {
"date": "2025-02-25T15:15:00Z",
"engine": {
"name": "V.A.",
"version": "1.0"
}
},
"id": "NCSC-2025-0115",
"initial_release_date": "2025-04-09T08:08:15.866613Z",
"revision_history": [
{
"date": "2025-04-09T08:08:15.866613Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-8734",
"product_identification_helper": {
"cpe": "cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "ColdFusion"
}
],
"category": "vendor",
"name": "Adobe"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-24446",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-8734"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24446",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24446.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-8734"
]
}
],
"title": "CVE-2025-24446"
},
{
"cve": "CVE-2025-30293",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-8734"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30293",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30293.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-8734"
]
}
],
"title": "CVE-2025-30293"
},
{
"cve": "CVE-2025-30292",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-8734"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30292",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30292.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-8734"
]
}
],
"title": "CVE-2025-30292"
},
{
"cve": "CVE-2025-30290",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-8734"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30290",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30290.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-8734"
]
}
],
"title": "CVE-2025-30290"
},
{
"cve": "CVE-2025-30288",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "other",
"text": "Improper Access Control",
"title": "CWE-284"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-8734"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30288",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30288.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-8734"
]
}
],
"title": "CVE-2025-30288"
},
{
"cve": "CVE-2025-30287",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"notes": [
{
"category": "other",
"text": "Improper Authentication",
"title": "CWE-287"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-8734"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30287",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30287.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-8734"
]
}
],
"title": "CVE-2025-30287"
},
{
"cve": "CVE-2025-30286",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-8734"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30286",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30286.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-8734"
]
}
],
"title": "CVE-2025-30286"
},
{
"cve": "CVE-2025-30285",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-8734"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30285",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30285.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-8734"
]
}
],
"title": "CVE-2025-30285"
},
{
"cve": "CVE-2025-30284",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-8734"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30284",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30284.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-8734"
]
}
],
"title": "CVE-2025-30284"
},
{
"cve": "CVE-2025-30282",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"notes": [
{
"category": "other",
"text": "Improper Authentication",
"title": "CWE-287"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-8734"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30282",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30282.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-8734"
]
}
],
"title": "CVE-2025-30282"
},
{
"cve": "CVE-2025-24447",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-8734"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24447",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24447.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-8734"
]
}
],
"title": "CVE-2025-24447"
},
{
"cve": "CVE-2025-30281",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "other",
"text": "Improper Access Control",
"title": "CWE-284"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-8734"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30281",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30281.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-8734"
]
}
],
"title": "CVE-2025-30281"
},
{
"cve": "CVE-2025-30294",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-8734"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30294",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30294.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-8734"
]
}
],
"title": "CVE-2025-30294"
},
{
"cve": "CVE-2025-30289",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-8734"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30289",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30289.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-8734"
]
}
],
"title": "CVE-2025-30289"
},
{
"cve": "CVE-2025-30291",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-8734"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30291",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30291.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-8734"
]
}
],
"title": "CVE-2025-30291"
}
]
}
WID-SEC-W-2025-0753
Vulnerability from csaf_certbund - Published: 2025-04-08 22:00 - Updated: 2025-04-08 22:00Summary
Adobe Creative Cloud Applikationen: Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Adobe Creative Cloud umfasst Anwendungen und Dienste für Video, Design, Fotografie und Web.
Angriff: Ein Angreifer kann mehrere Schwachstellen in Adobe Creative Cloud-Applikationen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen und Sicherheitsmaßnahmen zu umgehen.
Betroffene Betriebssysteme: - MacOS X
- Sonstiges
- Windows
References
| URL | Category | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Adobe Creative Cloud umfasst Anwendungen und Dienste f\u00fcr Video, Design, Fotografie und Web.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in Adobe Creative Cloud-Applikationen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuf\u00fchren und Sicherheitsma\u00dfnahmen zu umgehen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- MacOS X\n- Sonstiges\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2025-0753 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0753.json"
},
{
"category": "self",
"summary": "WID-SEC-2025-0753 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-0753"
},
{
"category": "external",
"summary": "Adobe Security Bulletin APSB25-23 vom 2025-04-08",
"url": "https://helpx.adobe.com/security/products/after_effects/apsb25-23.html"
},
{
"category": "external",
"summary": "Adobe Security Bulletin APSB25-31 vom 2025-04-08",
"url": "https://helpx.adobe.com/security/products/animate/apsb25-31.html"
},
{
"category": "external",
"summary": "Adobe Security Bulletin APSB25-25 vom 2025-04-08",
"url": "https://helpx.adobe.com/security/products/bridge/apsb25-25.html"
},
{
"category": "external",
"summary": "Adobe Security Bulletin APSB25-15 vom 2025-04-08",
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html"
},
{
"category": "external",
"summary": "Adobe Security Bulletin APSB25-24 vom 2025-04-08",
"url": "https://helpx.adobe.com/security/products/media-encoder/apsb25-24.html"
},
{
"category": "external",
"summary": "Adobe Security Bulletin APSB25-28 vom 2025-04-08",
"url": "https://helpx.adobe.com/security/products/premiere_pro/apsb25-28.html"
}
],
"source_lang": "en-US",
"title": "Adobe Creative Cloud Applikationen: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2025-04-08T22:00:00.000+00:00",
"generator": {
"date": "2025-04-09T08:20:19.298+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.12"
}
},
"id": "WID-SEC-W-2025-0753",
"initial_release_date": "2025-04-08T22:00:00.000+00:00",
"revision_history": [
{
"date": "2025-04-08T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "After Effects \u003c24.6.5",
"product": {
"name": "Adobe Creative Cloud After Effects \u003c24.6.5",
"product_id": "T042544"
}
},
{
"category": "product_version_range",
"name": "After Effects 24.6.5",
"product": {
"name": "Adobe Creative Cloud After Effects 24.6.5",
"product_id": "T042544-fixed"
}
},
{
"category": "product_version_range",
"name": "After Effects \u003c25.2",
"product": {
"name": "Adobe Creative Cloud After Effects \u003c25.2",
"product_id": "T042545"
}
},
{
"category": "product_version_range",
"name": "After Effects 25.2",
"product": {
"name": "Adobe Creative Cloud After Effects 25.2",
"product_id": "T042545-fixed"
}
},
{
"category": "product_version_range",
"name": "Animate\u202f 2023 \u003c23.0.11",
"product": {
"name": "Adobe Creative Cloud Animate\u202f 2023 \u003c23.0.11",
"product_id": "T042546"
}
},
{
"category": "product_version",
"name": "Animate\u202f 2023 23.0.11",
"product": {
"name": "Adobe Creative Cloud Animate\u202f 2023 23.0.11",
"product_id": "T042546-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:animate_2023__23.0.11"
}
}
},
{
"category": "product_version_range",
"name": "Animate\u202f 2024 \u003c24.0.8",
"product": {
"name": "Adobe Creative Cloud Animate\u202f 2024 \u003c24.0.8",
"product_id": "T042547"
}
},
{
"category": "product_version",
"name": "Animate\u202f 2024 24.0.8",
"product": {
"name": "Adobe Creative Cloud Animate\u202f 2024 24.0.8",
"product_id": "T042547-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:animate_2024__24.0.8"
}
}
},
{
"category": "product_version_range",
"name": "Bridge\u202f \u003c14.1.6",
"product": {
"name": "Adobe Creative Cloud Bridge\u202f \u003c14.1.6",
"product_id": "T042548"
}
},
{
"category": "product_version",
"name": "Bridge\u202f 14.1.6",
"product": {
"name": "Adobe Creative Cloud Bridge\u202f 14.1.6",
"product_id": "T042548-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:bridge__14.1.6"
}
}
},
{
"category": "product_version_range",
"name": "Bridge\u202f \u003c15.0.3",
"product": {
"name": "Adobe Creative Cloud Bridge\u202f \u003c15.0.3",
"product_id": "T042549"
}
},
{
"category": "product_version",
"name": "Bridge\u202f 15.0.3",
"product": {
"name": "Adobe Creative Cloud Bridge\u202f 15.0.3",
"product_id": "T042549-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:bridge__15.0.3"
}
}
},
{
"category": "product_version_range",
"name": "ColdFusion 2025 \u003cUpdate 1",
"product": {
"name": "Adobe Creative Cloud ColdFusion 2025 \u003cUpdate 1",
"product_id": "T042550"
}
},
{
"category": "product_version",
"name": "ColdFusion 2025 Update 1",
"product": {
"name": "Adobe Creative Cloud ColdFusion 2025 Update 1",
"product_id": "T042550-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:coldfusion_2025__update_1"
}
}
},
{
"category": "product_version_range",
"name": "ColdFusion 2023 \u003cUpdate 13",
"product": {
"name": "Adobe Creative Cloud ColdFusion 2023 \u003cUpdate 13",
"product_id": "T042551"
}
},
{
"category": "product_version",
"name": "ColdFusion 2023 Update 13",
"product": {
"name": "Adobe Creative Cloud ColdFusion 2023 Update 13",
"product_id": "T042551-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:coldfusion_2023__update_13"
}
}
},
{
"category": "product_version_range",
"name": "ColdFusion 2021 \u003cUpdate 19",
"product": {
"name": "Adobe Creative Cloud ColdFusion 2021 \u003cUpdate 19",
"product_id": "T042552"
}
},
{
"category": "product_version",
"name": "ColdFusion 2021 Update 19",
"product": {
"name": "Adobe Creative Cloud ColdFusion 2021 Update 19",
"product_id": "T042552-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:coldfusion_2021__update_19"
}
}
},
{
"category": "product_version_range",
"name": "Media Encoder \u003c24.6.5",
"product": {
"name": "Adobe Creative Cloud Media Encoder \u003c24.6.5",
"product_id": "T042553"
}
},
{
"category": "product_version",
"name": "Media Encoder 24.6.5",
"product": {
"name": "Adobe Creative Cloud Media Encoder 24.6.5",
"product_id": "T042553-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:media_encoder__24.6.5"
}
}
},
{
"category": "product_version_range",
"name": "Media Encoder \u003c25.2",
"product": {
"name": "Adobe Creative Cloud Media Encoder \u003c25.2",
"product_id": "T042554"
}
},
{
"category": "product_version",
"name": "Media Encoder 25.2",
"product": {
"name": "Adobe Creative Cloud Media Encoder 25.2",
"product_id": "T042554-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:media_encoder__25.2"
}
}
},
{
"category": "product_version_range",
"name": "Premiere Pro \u003c25.2",
"product": {
"name": "Adobe Creative Cloud Premiere Pro \u003c25.2",
"product_id": "T042555"
}
},
{
"category": "product_version",
"name": "Premiere Pro 25.2",
"product": {
"name": "Adobe Creative Cloud Premiere Pro 25.2",
"product_id": "T042555-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:premiere_pro__25.2"
}
}
},
{
"category": "product_version_range",
"name": "Premiere Pro \u003c24.6.5",
"product": {
"name": "Adobe Creative Cloud Premiere Pro \u003c24.6.5",
"product_id": "T042556"
}
},
{
"category": "product_version",
"name": "Premiere Pro 24.6.5",
"product": {
"name": "Adobe Creative Cloud Premiere Pro 24.6.5",
"product_id": "T042556-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:premiere_pro__24.6.5"
}
}
}
],
"category": "product_name",
"name": "Creative Cloud"
}
],
"category": "vendor",
"name": "Adobe"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-27182",
"product_status": {
"known_affected": [
"T042544",
"T042545"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-27182"
},
{
"cve": "CVE-2025-27183",
"product_status": {
"known_affected": [
"T042544",
"T042545"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-27183"
},
{
"cve": "CVE-2025-27184",
"product_status": {
"known_affected": [
"T042544",
"T042545"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-27184"
},
{
"cve": "CVE-2025-27185",
"product_status": {
"known_affected": [
"T042544",
"T042545"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-27185"
},
{
"cve": "CVE-2025-27186",
"product_status": {
"known_affected": [
"T042544",
"T042545"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-27186"
},
{
"cve": "CVE-2025-27187",
"product_status": {
"known_affected": [
"T042544",
"T042545"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-27187"
},
{
"cve": "CVE-2025-27204",
"product_status": {
"known_affected": [
"T042544",
"T042545"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-27204"
},
{
"cve": "CVE-2025-27199",
"product_status": {
"known_affected": [
"T042546",
"T042547"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-27199"
},
{
"cve": "CVE-2025-27200",
"product_status": {
"known_affected": [
"T042546",
"T042547"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-27200"
},
{
"cve": "CVE-2025-27201",
"product_status": {
"known_affected": [
"T042546",
"T042547"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-27201"
},
{
"cve": "CVE-2025-27202",
"product_status": {
"known_affected": [
"T042546",
"T042547"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-27202"
},
{
"cve": "CVE-2025-27193",
"product_status": {
"known_affected": [
"T042548",
"T042549"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-27193"
},
{
"cve": "CVE-2025-24446",
"product_status": {
"known_affected": [
"T042552",
"T042550",
"T042551"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-24446"
},
{
"cve": "CVE-2025-24447",
"product_status": {
"known_affected": [
"T042552",
"T042550",
"T042551"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-24447"
},
{
"cve": "CVE-2025-30281",
"product_status": {
"known_affected": [
"T042552",
"T042550",
"T042551"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-30281"
},
{
"cve": "CVE-2025-30282",
"product_status": {
"known_affected": [
"T042552",
"T042550",
"T042551"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-30282"
},
{
"cve": "CVE-2025-30284",
"product_status": {
"known_affected": [
"T042552",
"T042550",
"T042551"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-30284"
},
{
"cve": "CVE-2025-30285",
"product_status": {
"known_affected": [
"T042552",
"T042550",
"T042551"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-30285"
},
{
"cve": "CVE-2025-30286",
"product_status": {
"known_affected": [
"T042552",
"T042550",
"T042551"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-30286"
},
{
"cve": "CVE-2025-30287",
"product_status": {
"known_affected": [
"T042552",
"T042550",
"T042551"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-30287"
},
{
"cve": "CVE-2025-30288",
"product_status": {
"known_affected": [
"T042552",
"T042550",
"T042551"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-30288"
},
{
"cve": "CVE-2025-30289",
"product_status": {
"known_affected": [
"T042552",
"T042550",
"T042551"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-30289"
},
{
"cve": "CVE-2025-30290",
"product_status": {
"known_affected": [
"T042552",
"T042550",
"T042551"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-30290"
},
{
"cve": "CVE-2025-30291",
"product_status": {
"known_affected": [
"T042552",
"T042550",
"T042551"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-30291"
},
{
"cve": "CVE-2025-30292",
"product_status": {
"known_affected": [
"T042552",
"T042550",
"T042551"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-30292"
},
{
"cve": "CVE-2025-30293",
"product_status": {
"known_affected": [
"T042552",
"T042550",
"T042551"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-30293"
},
{
"cve": "CVE-2025-30294",
"product_status": {
"known_affected": [
"T042552",
"T042550",
"T042551"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-30294"
},
{
"cve": "CVE-2025-27194",
"product_status": {
"known_affected": [
"T042553",
"T042554"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-27194"
},
{
"cve": "CVE-2025-27195",
"product_status": {
"known_affected": [
"T042553",
"T042554"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-27195"
},
{
"cve": "CVE-2025-27196",
"product_status": {
"known_affected": [
"T042555",
"T042556"
]
},
"release_date": "2025-04-08T22:00:00.000+00:00",
"title": "CVE-2025-27196"
}
]
}
FKIE_CVE-2025-30281
Vulnerability from fkie_nvd - Published: 2025-04-08 20:15 - Updated: 2025-07-15 18:40
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Summary
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction, and scope is changed.
References
| URL | Tags | ||
|---|---|---|---|
| psirt@adobe.com | https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2021 | |
| adobe | coldfusion | 2023 | |
| adobe | coldfusion | 2023 | |
| adobe | coldfusion | 2023 | |
| adobe | coldfusion | 2023 | |
| adobe | coldfusion | 2023 | |
| adobe | coldfusion | 2023 | |
| adobe | coldfusion | 2023 | |
| adobe | coldfusion | 2023 | |
| adobe | coldfusion | 2023 | |
| adobe | coldfusion | 2023 | |
| adobe | coldfusion | 2023 | |
| adobe | coldfusion | 2023 | |
| adobe | coldfusion | 2023 | |
| adobe | coldfusion | 2025 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*",
"matchCriteriaId": "7A94B406-C011-4673-8C2B-0DD94D46CC4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*",
"matchCriteriaId": "AFD05E3A-10F9-4C75-9710-BA46B66FF6E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:*",
"matchCriteriaId": "F1FC7D1D-6DD2-48B2-980F-B001B0F24473",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:*",
"matchCriteriaId": "1FA19E1D-61C2-4640-AF06-4BCFE750BDF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update12:*:*:*:*:*:*",
"matchCriteriaId": "3F331DEA-F3D0-4B13-AB1E-6FE39B2BB55D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update13:*:*:*:*:*:*",
"matchCriteriaId": "63D5CF84-4B0D-48AE-95D6-262AEA2FFDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update14:*:*:*:*:*:*",
"matchCriteriaId": "10616A3A-0C1C-474A-BD7D-A2A5BB870F74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update15:*:*:*:*:*:*",
"matchCriteriaId": "D7DA523E-1D9B-45FD-94D9-D4F9F2B9296B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update16:*:*:*:*:*:*",
"matchCriteriaId": "151AFF8B-F05C-4D27-85FC-DF88E9C11BEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update17:*:*:*:*:*:*",
"matchCriteriaId": "53A0E245-2915-4DFF-AFB5-A12F5C435702",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update18:*:*:*:*:*:*",
"matchCriteriaId": "C5653D18-7534-48A3-819F-9F049A418F99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*",
"matchCriteriaId": "D57C8681-AC68-47DF-A61E-B5C4B4A47663",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*",
"matchCriteriaId": "75608383-B727-48D6-8FFA-D552A338A562",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*",
"matchCriteriaId": "7773DB68-414A-4BA9-960F-52471A784379",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*",
"matchCriteriaId": "B38B9E86-BCD5-4BCA-8FB7-EC55905184E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*",
"matchCriteriaId": "5E7BAB80-8455-4570-A2A2-8F40469EE9CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*",
"matchCriteriaId": "F9D645A2-E02D-4E82-A2BD-0A7DE5B8FBCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update8:*:*:*:*:*:*",
"matchCriteriaId": "6E22D701-B038-4795-AA32-A18BC93C2B6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2021:update9:*:*:*:*:*:*",
"matchCriteriaId": "CAC4A0EC-C3FC-47D8-86CE-0E6A87A7F0B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*",
"matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*",
"matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*",
"matchCriteriaId": "645D1B5F-2DAB-4AB8-A465-AC37FF494F95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*",
"matchCriteriaId": "ED6D8996-0770-4C9F-BEA5-87EA479D40A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*",
"matchCriteriaId": "4836086E-3D4A-4A07-A372-382D385CB490",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*",
"matchCriteriaId": "EB88D4FE-5496-4639-BAF2-9F29F24ABF29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*",
"matchCriteriaId": "43E0ED98-2C1F-40B8-AF60-FEB1D85619C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*",
"matchCriteriaId": "76204873-C6E0-4202-8A03-0773270F1802",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*",
"matchCriteriaId": "C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*",
"matchCriteriaId": "E3A83642-BF14-4C37-BD94-FA76AABE8ADC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*",
"matchCriteriaId": "A892E1DC-F2C8-4F53-8580-A2D1BEED5A25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*",
"matchCriteriaId": "DB97ADBA-C1A9-4EE0-9509-68CB12358AE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*",
"matchCriteriaId": "E17C38F0-9B0F-4433-9CBD-6E3D63EA9BDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:*",
"matchCriteriaId": "30779417-D4E5-4A01-BE0E-1CE1D134292A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction, and scope is changed."
},
{
"lang": "es",
"value": "Las versiones 2023.12, 2021.18, 2025.0 y anteriores de ColdFusion se ven afectadas por una vulnerabilidad de control de acceso inadecuado que podr\u00eda provocar la lectura arbitraria del sistema de archivos. Un atacante podr\u00eda aprovechar esta vulnerabilidad para acceder o modificar datos confidenciales sin la debida autorizaci\u00f3n. Para explotar este problema no se requiere la interacci\u00f3n del usuario."
}
],
"id": "CVE-2025-30281",
"lastModified": "2025-07-15T18:40:24.337",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 6.0,
"source": "psirt@adobe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 6.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-04-08T20:15:25.670",
"references": [
{
"source": "psirt@adobe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html"
}
],
"sourceIdentifier": "psirt@adobe.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-284"
}
],
"source": "psirt@adobe.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-R3M2-P27F-8635
Vulnerability from github – Published: 2025-04-08 21:31 – Updated: 2025-04-08 21:31
VLAI?
Details
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction.
Severity ?
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-30281"
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-08T20:15:25Z",
"severity": "CRITICAL"
},
"details": "ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction.",
"id": "GHSA-r3m2-p27f-8635",
"modified": "2025-04-08T21:31:40Z",
"published": "2025-04-08T21:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30281"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
CNVD-2025-07251
Vulnerability from cnvd - Published: 2025-04-15
VLAI Severity ?
Title
Adobe ColdFusion访问控制不漏洞
Description
Adobe ColdFusion是美国奥多比（Adobe）公司的一套快速应用程序开发平台。该平台包括集成开发环境和脚本语言。
Adobe ColdFusion存在访问控制不漏洞，攻击者可利用此漏洞读取任意文件系统。
Severity
高
Patch Name
Adobe ColdFusion访问控制不漏洞的补丁
Patch Description
Adobe ColdFusion是美国奥多比（Adobe）公司的一套快速应用程序开发平台。该平台包括集成开发环境和脚本语言。
Adobe ColdFusion存在访问控制不漏洞，攻击者可利用此漏洞读取任意文件系统。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
用户可参考如下厂商提供的安全补丁以修复该漏洞： https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html
Reference
https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html
Impacted products
| Name | ['Adobe ColdFusion 2025 Build 331385', 'Adobe ColdFusion 2023 <=Update 12', 'Adobe ColdFusion 2021 <=Update 18'] |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2025-30281",
"cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-30281"
}
},
"description": "Adobe ColdFusion\u662f\u7f8e\u56fd\u5965\u591a\u6bd4\uff08Adobe\uff09\u516c\u53f8\u7684\u4e00\u5957\u5feb\u901f\u5e94\u7528\u7a0b\u5e8f\u5f00\u53d1\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u5305\u62ec\u96c6\u6210\u5f00\u53d1\u73af\u5883\u548c\u811a\u672c\u8bed\u8a00\u3002\n\nAdobe ColdFusion\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u4e0d\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u8bfb\u53d6\u4efb\u610f\u6587\u4ef6\u7cfb\u7edf\u3002",
"formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u5382\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u8865\u4e01\u4ee5\u4fee\u590d\u8be5\u6f0f\u6d1e\uff1a\r\nhttps://helpx.adobe.com/security/products/coldfusion/apsb25-15.html",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2025-07251",
"openTime": "2025-04-15",
"patchDescription": "Adobe ColdFusion\u662f\u7f8e\u56fd\u5965\u591a\u6bd4\uff08Adobe\uff09\u516c\u53f8\u7684\u4e00\u5957\u5feb\u901f\u5e94\u7528\u7a0b\u5e8f\u5f00\u53d1\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u5305\u62ec\u96c6\u6210\u5f00\u53d1\u73af\u5883\u548c\u811a\u672c\u8bed\u8a00\u3002\r\n\r\nAdobe ColdFusion\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u4e0d\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u8bfb\u53d6\u4efb\u610f\u6587\u4ef6\u7cfb\u7edf\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Adobe ColdFusion\u8bbf\u95ee\u63a7\u5236\u4e0d\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": [
"Adobe ColdFusion 2025 Build 331385",
"Adobe ColdFusion 2023 \u003c=Update 12",
"Adobe ColdFusion 2021 \u003c=Update 18"
]
},
"referenceLink": "https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html",
"serverity": "\u9ad8",
"submitTime": "2025-04-14",
"title": "Adobe ColdFusion\u8bbf\u95ee\u63a7\u5236\u4e0d\u6f0f\u6d1e"
}
Loading…
Show additional events:
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…