Product:
ColdFusion
Summary
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could result in limited unauthorized write access. An attacker could leverage this vulnerability to gain unauthorized access by exploiting improperly stored or transmitted credentials. Exploitation of this issue does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2025-64898 |
Exploitation
An attacker can exploit this vulnerability by targeting improperly stored or transmitted credentials within the affected ColdFusion versions. By leveraging the low attack complexity and network attack vector, the attacker can gain unauthorized access without needing user interaction, making it easier to exploit.
Affected Products
- ColdFusion 2025.4: Affected by insufficiently protected credentials.
- ColdFusion 2023.16: Vulnerable to unauthorized write access due to credential issues.
- ColdFusion 2021.22: Exposed to risks from improperly stored credentials.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of ColdFusion where the issue has been addressed. Additionally, ensure that credentials are stored and transmitted securely to prevent unauthorized access.