Skip to main content
IMMUNITYSEC

CVE-2013-0632

9.8
CRITICAL
CVSS 3.1
EPSS 93.6% · 100th pctCISA KEV · Exploited in the wild
2013-01-17•Updated 2025-10-22•KEV 2022-03-03
CISA Known Exploited Vulnerabilities

Adobe ColdFusion Authentication Bypass Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV
2022-03-03
Remediation due
2022-03-24

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2013-0632

Description

administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.

Severity

CVSS 3.1 · CISA9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC · CISA-ADP
Exploitationactive
Automatableyes
Technical impacttotal

Affected Products

VendorProductAffected versions
--
n/a

References

3 Links
Exploits & PoCs

Record Details

Published
2013-01-17
Last updated
2025-10-22
Assigner (CNA)
adobe
Credited to
-

More from Adobe

All Adobe CVEs→
CVE-2023-293009.8 CRITICAL

Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

AdobeKEVEPSS 100.0%2023-07-12
CVE-2018-159619.8 CRITICAL

Adobe ColdFusion Unrestricted File Upload Vulnerability

AdobeKEVEPSS 100.0%2018-09-25
CVE-2023-292987.5 HIGH

Adobe ColdFusion Improper Access Control Security feature bypass

AdobeKEVEPSS 99.8%2023-07-12
CVE-2023-382057.5 HIGH

ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298

AdobeKEVEPSS 99.8%2023-09-14

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.