Product:
ColdFusion
Summary
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability. A low privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access potentially resulting in denial of service. Exploitation of this issue requires user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.6 | CVE-2025-64897 |
Exploitation
To exploit this vulnerability, an attacker with low privileges must interact with the affected system. By leveraging the improper access control, the attacker can bypass security measures and gain unauthorized write access, which could lead to a denial of service.
Affected Products
- ColdFusion 2025.4: Affected by improper access control, allowing unauthorized write access.
- ColdFusion 2023.16: Vulnerable to exploitation leading to potential denial of service.
- ColdFusion 2021.22: Similar vulnerabilities as other versions, requiring user interaction for exploitation.
Mitigation
To mitigate this vulnerability, users should update to the latest version of ColdFusion that addresses the improper access control issue. Regularly applying security patches and following best practices for user permissions can also help reduce the risk of exploitation.