{"id":13996,"date":"2025-04-09T04:31:09","date_gmt":"2025-04-09T04:31:09","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/adobe-patches-11-critical-coldfusion-flaws\/"},"modified":"2025-04-09T04:31:10","modified_gmt":"2025-04-09T04:31:10","slug":"adobe-patches-11-critical-coldfusion-flaws","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/adobe-patches-11-critical-coldfusion-flaws\/","title":{"rendered":"Adobe Patches 11 Critical ColdFusion Flaws"},"content":{"rendered":"\n<\/p>\n<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Apr 09, 2025<\/span><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><\/span><span class=\"p-tags\">Software Security \/ Vulnerability<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\">\n<a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiKN7ljPZp_RS0fV3zDl0S9A9o1It7jMPYsnHQBJ5lxrT9qE2754qMYaxZ1NOx4EU3Vpkbza2ogu33iceS_Tvk0AH6PYIiiRIpRm5AncbF2E44KClhuvjD66Mn6x1cji_r58DU8pLSUHzYrgkU7PGo5xtlSzkNcyb9g7SDMZTsPMz5P91lcXzJZa72qck-w\/s728-rw-e365\/adobe-patch-update.jpg\" style=\"clear: left; display: block; float: left;  text-align: center;\" rel=\"nofollow noopener\" target=\"_blank\"><\/p>\n<p><\/a>\n<\/div>\n<p>Adobe has <a href=\"https:\/\/helpx.adobe.com\/security.html\" rel=\"noopener nofollow\" target=\"_blank\">released<\/a> security updates to fix a fresh set of security flaws, including multiple critical-severity bugs in ColdFusion versions\u202f2025, 2023 and 2021 that could result in arbitrary file read and code execution.<\/p>\n<p>Of the 30 flaws in the product, 11 are rated Critical in severity &#8211;<\/p>\n<ul>\n<li><strong>CVE-2025-24446<\/strong> (CVSS score: 9.1) &#8211; An improper input validation vulnerability that could result in an arbitrary file system read<\/li>\n<li><strong>CVE-2025-24447<\/strong> (CVSS score: 9.1) &#8211; A deserialization of untrusted data vulnerability that could result in arbitrary code execution<\/li>\n<li><strong>CVE-2025-30281<\/strong> (CVSS score: 9.1) &#8211; An improper access control vulnerability that could result in an arbitrary file system read<\/li>\n<li><strong>CVE-2025-30282<\/strong> (CVSS score: 9.1) &#8211; An improper authentication vulnerability that could result in arbitrary code execution<\/li>\n<li><strong>CVE-2025-30284<\/strong> (CVSS score: 8.0) &#8211; A deserialization of untrusted data vulnerability that could result in arbitrary code execution<\/li>\n<li><strong>CVE-2025-30285<\/strong> (CVSS score: 8.0) &#8211; A deserialization of untrusted data vulnerability that could result in arbitrary code execution<\/li>\n<li><strong>CVE-2025-30286<\/strong> (CVSS score: 8.0) &#8211; An operating system command injection vulnerability that could result in arbitrary code execution <\/li>\n<li><strong>CVE-2025-30287<\/strong> (CVSS score: 8.1) &#8211; An improper authentication vulnerability that could result in arbitrary code execution<\/li>\n<li><strong>CVE-2025-30288<\/strong> (CVSS score: 7.8) &#8211; An improper access control vulnerability that could result in a security feature bypass<\/li>\n<li><strong>CVE-2025-30289<\/strong> (CVSS score: 7.5) &#8211; An operating system command injection vulnerability that could result in arbitrary code execution<\/li>\n<li><strong>CVE-2025-30290<\/strong> (CVSS score: 8.7) &#8211; A path traversal vulnerability that could result in a security feature bypass<\/li>\n<\/ul>\n<div class=\"dog_two clear\"><center class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/drata-1\" rel=\"nofollow noopener sponsored\" target=\"_blank\" title=\"Cybersecurity\"><img fetchpriority=\"high\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgknoEyfYZNKBvxuKcSZ6K2_S3HJ9fTw-26Vf3GSPy2j-2cCGECPjEKXjfmnKd-i0NwAtYY5vhRu2naFl3_ZV6LPibQSUGReGfMmgnU-w-6Ba4Aq51nxtT2rVtXOJc4G06_xeAFK0z3GQsdUj8Up_hd-tMyAIzlz_Vjxj5M5wyqfqydhu8-BOk59f6yRaOZ\/s728-e300\/drata-1-d.png\" width=\"727\" height=\"90\"\/><\/a><\/center><\/div>\n<p>&#8220;These updates resolve critical and important vulnerabilities\u202fthat could lead to\u202farbitrary file system read, arbitrary code execution and security feature bypass,&#8221; Adobe <a href=\"https:\/\/helpx.adobe.com\/security\/products\/coldfusion\/apsb25-15.html\" rel=\"noopener nofollow\" target=\"_blank\">said<\/a> in an advisory.<\/p>\n<p>The vulnerabilities have been resolved in the below versions &#8211;<\/p>\n<ul>\n<li>ColdFusion 2021 Update 19<\/li>\n<li>ColdFusion 2023 Update 13, and<\/li>\n<li>ColdFusion 2025 Update 1<\/li>\n<\/ul>\n<p>Fixes have also been released to address several out-of-bounds write and heap-based buffer overflow bugs in <a href=\"https:\/\/helpx.adobe.com\/security\/products\/after_effects\/apsb25-23.html\" rel=\"noopener nofollow\" target=\"_blank\">After Effects<\/a> (CVE-2025-27182, CVE-2025-27183), <a href=\"https:\/\/helpx.adobe.com\/security\/products\/media-encoder\/apsb25-24.html\" rel=\"noopener nofollow\" target=\"_blank\">Media Encoder<\/a> (CVE-2025-27194, CVE-2025-27195), <a href=\"https:\/\/helpx.adobe.com\/security\/products\/bridge\/apsb25-25.html\" rel=\"noopener nofollow\" target=\"_blank\">Bridge<\/a> (CVE-2025-27193), <a href=\"https:\/\/helpx.adobe.com\/security\/products\/premiere_pro\/apsb25-28.html\" rel=\"noopener nofollow\" target=\"_blank\">Premiere Pro<\/a> (CVE-2025-27196), <a href=\"https:\/\/helpx.adobe.com\/security\/products\/photoshop\/apsb25-30.html\" rel=\"noopener nofollow\" target=\"_blank\">Photoshop<\/a> (CVE-2025-27198), <a href=\"https:\/\/helpx.adobe.com\/security\/products\/animate\/apsb25-31.html\" rel=\"noopener nofollow\" target=\"_blank\">Animate<\/a> (CVE-2025-27199), and <a href=\"https:\/\/helpx.adobe.com\/security\/products\/framemaker\/apsb25-33.html\" rel=\"noopener nofollow\" target=\"_blank\">FrameMaker<\/a> (CVE-2025-30304, CVE-2025-30297, CVE-2025-30295) that could lead to arbitrary code execution.<\/p>\n<p>Adobe also noted that it&#8217;s not aware of any exploits for any of the aforementioned shortcomings. That said, it&#8217;s essential that users update their installations to the latest version to safeguard against potential threats.<\/p>\n<p><\/p>\n<div class=\"cf note-b\">Found this article interesting?  Follow us on <a href=\"https:\/\/twitter.com\/thehackersnews\" rel=\"noopener nofollow\" target=\"_blank\">Twitter <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a> and <a href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" rel=\"noopener nofollow\" target=\"_blank\">LinkedIn<\/a> to read more exclusive content we post.<\/div>\n<\/div>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2025\/04\/adobe-patches-11-critical-coldfusion.html\" rel=\"nofollow noopener\" target=\"_blank\">Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ue802Apr 09, 2025\ue804Ravie LakshmananSoftware Security \/ Vulnerability Adobe has released security updates to fix a fresh set of security flaws, including multiple critical-severity bugs in ColdFusion versions\u202f2025, 2023 and 2021&#8230;<\/p>\n","protected":false},"author":19,"featured_media":13997,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-13996","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/04\/adobe-patch-update.jpg","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/13996","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=13996"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/13996\/revisions"}],"predecessor-version":[{"id":13998,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/13996\/revisions\/13998"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/13997"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=13996"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=13996"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=13996"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}