VulnerabilityAnalyzed
CVE-2013-0632
Adobe ColdFusion Authentication Bypass Vulnerability
KEVCRITICAL 9.8EPSS 93.7%
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 24 March 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 93.69% probability · 100th percentile
- CISA KEV
- Listed 3 March 2022 · due 24 March 2022
- Weakness
- CWE-276
- Affected
- adobe/coldfusion
- Source
- psirt@adobe.com
CISA notes
Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-0632
References
- http://www.adobe.com/support/security/advisories/apsa13-01.htmlMitigation, Vendor Advisory
- http://www.adobe.com/support/security/bulletins/apsb13-03.htmlBroken Link, Vendor Advisory
- http://www.exploit-db.com/exploits/30210Exploit, Third Party Advisory, VDB Entry
- http://www.adobe.com/support/security/advisories/apsa13-01.htmlMitigation, Vendor Advisory
- http://www.adobe.com/support/security/bulletins/apsb13-03.htmlBroken Link, Vendor Advisory
- http://www.exploit-db.com/exploits/30210Exploit, Third Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0632US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.