Adobe ColdFusion < 2021.x < 2021u23 / 2023.x < 2023u17 / 2025.x < 2025u5 Multiple Vulnerabilities (APSB25-105)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(278173);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/16");

  script_cve_id(
    "CVE-2025-61808",
    "CVE-2025-61809",
    "CVE-2025-61810",
    "CVE-2025-61811",
    "CVE-2025-61812",
    "CVE-2025-61813",
    "CVE-2025-61821",
    "CVE-2025-61822",
    "CVE-2025-61823",
    "CVE-2025-61830",
    "CVE-2025-64897",
    "CVE-2025-64898"
  );
  script_xref(name:"IAVA", value:"2025-A-0904-S");

  script_name(english:"Adobe ColdFusion < 2021.x < 2021u23 / 2023.x < 2023u17 / 2025.x < 2025u5 Multiple Vulnerabilities (APSB25-105)");

  script_set_attribute(attribute:"synopsis", value:
"A web-based application running on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Adobe ColdFusion installed on the remote Windows host is prior to 2021.x update 23, 2023.x update 17, or
2025.x update 5. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB25-105 advisory.

  - Adobe Pass versions 3.7.3 and earlier are affected by an Incorrect Authorization vulnerability. An
    attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and
    write access. Exploitation of this issue requires user interaction in that a victim must install a
    malicious SDK. (CVE-2025-61830)

  - ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation
    vulnerability that could result in a Security feature bypass. An attacker could leverage this
    vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of
    this issue does not require user interaction and scope is unchanged. (CVE-2025-61809)

  - ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Unrestricted Upload of File
    with Dangerous Type vulnerability that could lead to arbitrary code execution by a high priviledged
    attacker. Exploitation of this issue does not require user interaction and scope is changed.
    (CVE-2025-61808)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html");
  script_set_attribute(attribute:"solution", value:
"Update to Adobe ColdFusion version 2021 update 23 / 2023 update 17 / 2025 update 5 or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-61809");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-61821");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20, 284, 434, 502, 522, 611);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/11/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:coldfusion");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("coldfusion_win_local_detect.nasl");
  script_require_keys("SMB/coldfusion/instance");
  script_require_ports(139, 445);

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Adobe ColdFusion', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
        {
          'equal': '2021.0.0', 'fixed_display': 'Missing cumulative hotfix : chf2021000023.jar',
          'requires' : [{'scope': 'install', 'less': { 'chf_version': '23' }}]
        },
        {
          'equal': '2023.0.0', 'fixed_display': 'Missing cumulative hotfix : chf2023000017.jar',
          'requires' : [{'scope': 'install', 'less': { 'chf_version': '17' }}]
        },
        {
          'equal': '2025.0.0', 'fixed_display': 'Missing cumulative hotfix : chf2025000005.jar',
          'requires' : [{'scope': 'install', 'less': { 'chf_version': '5' }}]
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);