ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to limited file system read. A high-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| LOW | 2.2 | CVE-2025-54234 |
Exploitation
To exploit this vulnerability, an attacker with high privileges can craft requests that include arbitrary URLs, causing the ColdFusion application to make unintended requests. This can lead to unauthorized access to sensitive information on the server’s file system.
Affected Products
- ColdFusion 2025.1: The latest version affected by the SSRF vulnerability.
- ColdFusion 2023.13: An earlier version that is also vulnerable.
- ColdFusion 2021.19: Another version impacted by this security issue.
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest version of ColdFusion that addresses this SSRF issue. Additionally, implementing strict input validation and access controls can help reduce the risk of exploitation.