9.1

CVE-2025-24447

Medienbericht

ColdFusion | Deserialization of Untrusted Data (CWE-502)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user resulting in a High impact to Confidentiality and Integrity. Exploitation of this issue does not require user interaction.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Adobe ≫ Coldfusion Version2021 Update-
Adobe ≫ Coldfusion Version2021 Updateupdate1
Adobe ≫ Coldfusion Version2021 Updateupdate10
Adobe ≫ Coldfusion Version2021 Updateupdate11
Adobe ≫ Coldfusion Version2021 Updateupdate12
Adobe ≫ Coldfusion Version2021 Updateupdate13
Adobe ≫ Coldfusion Version2021 Updateupdate14
Adobe ≫ Coldfusion Version2021 Updateupdate15
Adobe ≫ Coldfusion Version2021 Updateupdate16
Adobe ≫ Coldfusion Version2021 Updateupdate17
Adobe ≫ Coldfusion Version2021 Updateupdate18
Adobe ≫ Coldfusion Version2021 Updateupdate2
Adobe ≫ Coldfusion Version2021 Updateupdate3
Adobe ≫ Coldfusion Version2021 Updateupdate4
Adobe ≫ Coldfusion Version2021 Updateupdate5
Adobe ≫ Coldfusion Version2021 Updateupdate6
Adobe ≫ Coldfusion Version2021 Updateupdate7
Adobe ≫ Coldfusion Version2021 Updateupdate8
Adobe ≫ Coldfusion Version2021 Updateupdate9
Adobe ≫ Coldfusion Version2023 Update-
Adobe ≫ Coldfusion Version2023 Updateupdate1
Adobe ≫ Coldfusion Version2023 Updateupdate10
Adobe ≫ Coldfusion Version2023 Updateupdate11
Adobe ≫ Coldfusion Version2023 Updateupdate12
Adobe ≫ Coldfusion Version2023 Updateupdate2
Adobe ≫ Coldfusion Version2023 Updateupdate3
Adobe ≫ Coldfusion Version2023 Updateupdate4
Adobe ≫ Coldfusion Version2023 Updateupdate5
Adobe ≫ Coldfusion Version2023 Updateupdate6
Adobe ≫ Coldfusion Version2023 Updateupdate7
Adobe ≫ Coldfusion Version2023 Updateupdate8
Adobe ≫ Coldfusion Version2023 Updateupdate9
Adobe ≫ Coldfusion Version2025 Update-
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 28.36% 0.964
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
psirt@adobe.com 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.