CVE-2025-30282 — Improper Authentication in Adobe Coldfusion

CWE-287 — Improper Authentication3 documents3 sources
Severity
9.1CRITICALNVD
EPSS
1.6%
top 18.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Adobe Coldfusion
Timeline
PublishedApr 8

Description

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass authentication mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HExploitability: 2.3 | Impact: 6.0

Affected Packages2 packages

▶CVEListV5adobe/coldfusion2025.0
▶NVDadobe/coldfusion2021, 2023, 2025+2

🔴Vulnerability Details

2
CVEList
ColdFusion | Improper Authentication (CWE-287)↗2025-04-08
▶
GHSA
GHSA-cp9f-7jr4-m2mj: ColdFusion versions 2023↗2025-04-08
▶
CVE-2025-30282 — Improper Authentication in Adobe | cvebase