How severe is CVE-2025-30287?

This vulnerability has a severity rating of HIGH with a CVSS score of 8.2 out of 10.

What type of vulnerability is CVE-2025-30287?

This is classified as CWE-287, which is a common weakness in software security.

CVE-2025-30287 - HIGH Severity | CVSS 8.2

Vulnerability Description

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of the current user. A low privileged attacker with local access could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction in that a victim must be coerced into performing actions within the application and scope is changed.

Related Vulnerabilities

CVE-2017-9625

HIGH

CVSS:8.2(High)

An Improper Authentication issue was discovered in Envitech EnviDAS Ultimate Versions prior to v1.0.0.5. The web application lacks proper authentication which could allow an attacker to view informati...

CWE-2872017

CVE-2020-16102

HIGH

CVSS:8.2(High)

Improper Authentication vulnerability in Gallagher Command Centre Server allows an unauthenticated remote attacker to create items with invalid configuration, potentially causing the server to crash a...

CWE-2872020

CVE-2020-16251

HIGH

CVSS:8.2(High)

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

CWE-2872020

CVE-2020-5148

HIGH

CVSS:8.2(High)

SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing method allows a potential attacker to capture the password hash of the privileged...

CWE-2872020

CVE-2020-7787

HIGH

CVSS:8.2(High)

This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing t...

CWE-2872020

CVE-2021-21378

HIGH

CVSS:8.2(High)

Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider l...

CWE-2872021