CVEvulnerability

CVE-2013-0632

9.8 CRITICAL Known exploited Published 2013-01-17 Modified 2026-06-16 Official page ↗

CISA Known Exploited Vulnerability

Adobe ColdFusion Authentication Bypass Vulnerability — Adobe ColdFusion

An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.

Added to KEV
2022-03-03
Remediation due
2022-03-24
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2013-0632
Status
Analyzed
Published
2013-01-17
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-276

Description

administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.

Affected configurations

• adobe coldfusion 9.0 • adobe coldfusion 9.0.1 • adobe coldfusion 9.0.2 • adobe coldfusion 10.0

Related

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References