Adobe ColdFusion up to 2021.19/2023.13/2025.1 authorization

Summaryinfo

A vulnerability was found in Adobe ColdFusion up to 2021.19/2023.13/2025.1. It has been declared as critical. Affected by this issue is some unknown functionality. Such manipulation leads to authorization. This vulnerability is traded as CVE-2025-43564. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Adobe ColdFusion up to 2021.19/2023.13/2025.1 and classified as critical. Affected by this issue is some unknown processing. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. Impacted is confidentiality, integrity, and availability. CVE summarizes:

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction.

The advisory is shared for download at helpx.adobe.com. This vulnerability is handled as CVE-2025-43564 since 04/16/2025. The exploitation is known to be easy. The attack may be launched remotely. Additional levels of successful authentication are needed for exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 236762 (Adobe ColdFusion 2021.x < 2021u20 / 2023.x < 2023u14 / 2025.x < 2025u2 Multiple Vulnerabilities (APSB25-52)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (236762) and EUVD (EUVD-2025-14523). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Adobe

Name

• ColdFusion

Version

• 2021.0
• 2021.1
• 2021.2
• 2021.3
• 2021.4
• 2021.5
• 2021.6
• 2021.7
• 2021.8
• 2021.9
• 2021.10
• 2021.11
• 2021.12
• 2021.13
• 2021.14
• 2021.15
• 2021.16
• 2021.17
• 2021.18
• 2021.19
• 2023.0
• 2023.1
• 2023.2
• 2023.3
• 2023.4
• 2023.5
• 2023.6
• 2023.7
• 2023.8
• 2023.9
• 2023.10
• 2023.11
• 2023.12
• 2023.13
• 2025.0
• 2025.1

License

• commercial

Website

• Vendor: https://www.adobe.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion