CVE-2025-61823
BaseFortify
Publication date: 2025-12-10
Last updated on: 2025-12-12
Assigner: Adobe Systems Incorporated
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| adobe | coldfusion | 2021.22 |
| adobe | coldfusion | 2023.16 |
| adobe | coldfusion | 2025.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-611 | The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Improper Restriction of XML External Entity Reference (XXE) in ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier. It allows a high privileged attacker to exploit XML processing to read arbitrary files on the server's file system by manipulating XML input. Exploitation requires user interaction and changes the scope of the attack.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker with high privileges to read sensitive files and data on the server, potentially exposing confidential information and compromising system security.