ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to limited file system read. A high-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| LOW | 2.2 | CVE-2025-54234 |
Exploitation
To exploit this vulnerability, an attacker with high privileges can craft requests that include arbitrary URLs, which the ColdFusion application will process. This allows the attacker to access files on the server that should not be accessible, potentially leading to sensitive information disclosure.
Affected Products
- ColdFusion 2025.1: The latest version affected by the SSRF vulnerability.
- ColdFusion 2023.13: An earlier version that is also vulnerable.
- ColdFusion 2021.19: Another version impacted by this security issue.
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest version of ColdFusion that addresses this SSRF issue. Additionally, implementing strict input validation and limiting the privileges of authenticated users can help reduce the risk of exploitation.