Количество 3
Количество 3
CVE-2025-49539
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses.
GHSA-rwpc-fvp2-p5wp
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses.
BDU:2025-08382
Уязвимость программной платформы ColdFusion, связанная с неверным ограничением XML-ссылок на внешние объекты, позволяющая нарушителю обойти ограничения безопасности
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2025-49539 ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses. | CVSS3: 4.5 | 0% Низкий | около 1 года назад |
| GHSA-rwpc-fvp2-p5wp ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses. | CVSS3: 4.5 | 0% Низкий | около 1 года назад |
 | BDU:2025-08382 Уязвимость программной платформы ColdFusion, связанная с неверным ограничением XML-ссылок на внешние объекты, позволяющая нарушителю обойти ограничения безопасности | CVSS3: 6.5 | 0% Низкий | около 1 года назад |
Уязвимостей на страницу