CVE-2025-61823
ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
En bref Sévérité MEDIUM 6.2 EPSS EPSS 0.49 % · centile 42 (2026-10-27) État PUBLISHED Publiée 2025-12-09 Mise à jour 2025-12-10 Attribuée par adobe Statut NVD Analyzed Description ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A high privileged attacker could exploit this vulnerability to access sensitive files and data on the server. Exploitation of this issue requires user interaction and scope is changed.
Scores Version Score Vecteur Évalué par CVSS 3.1 MEDIUM 6.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N adobe CVSS 3.1 MEDIUM 6.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N NVD · psirt@adobe.com (Secondary)
Faiblesses (CWE)
Références européennes
Configurations affectées (CPE NVD) cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update12:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update13:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update14:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update15:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update16:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update17:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update18:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update19:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update20:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update21:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update22:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update8:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2021:update9:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*+5 autres Produits affectés
Références
Sources
