Product:
ColdFusion
Summary
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could leverage this vulnerability to bypass security measures and execute malicious code. Exploitation of this issue does not require user interaction and scope is changed.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2025-61811 |
Exploitation
To exploit this vulnerability, an attacker with high privileges can send specially crafted requests over the network to the affected ColdFusion server. By bypassing security measures, the attacker can execute arbitrary code in the context of the current user without needing any user interaction, making it a significant risk.
Affected Products
- ColdFusion 2025.4: Affected by improper access control leading to potential code execution.
- ColdFusion 2023.16: Vulnerable to exploitation through network requests.
- ColdFusion 2021.22: Can be compromised by high privileged attackers.
Mitigation
To mitigate this vulnerability, it is recommended to update ColdFusion to the latest version that addresses the improper access control issue. Additionally, implementing strict access controls and monitoring network traffic can help reduce the risk of exploitation.