{"id":"CVE-2013-0632","url":"https://www.cyber-defence.io/tools/cve/CVE-2013-0632","generatedAt":"2026-10-31T23:40:28.860Z","title":"Adobe ColdFusion Authentication Bypass Vulnerability","description":"administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.","published":"2013-01-17T00:55:01.000Z","lastModified":"2026-06-16T23:49:48.000Z","status":"Analyzed","sourceIdentifier":"psirt@adobe.com","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-276"],"affected":["adobe/coldfusion"],"epss":{"score":0.93076,"percentile":0.99833,"date":"2026-10-30","history":[]},"kev":{"listed":true,"dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","notes":"Apply updates per vendor instructions.\nhttps://nvd.nist.gov/vuln/detail/CVE-2013-0632"},"exploits":{"count":3,"verified":true,"firstPublished":"2013-04-10","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":30210,"kind":"exploit","title":"Adobe ColdFusion 9 - Administrative Authentication Bypass (Metasploit)","url":"https://www.exploit-db.com/exploits/30210","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/30210.rb","file":"exploits/multiple/remote/30210.rb","published":"2013-12-11","added":"2013-12-11","updated":"2013-12-11","author":"Metasploit","type":"remote","platform":"multiple","port":80,"verified":true,"codes":["CVE-2013-0632"],"tags":"Metasploit Framework (MSF)","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":27755,"kind":"exploit","title":"Adobe ColdFusion 9 - Administrative Authentication Bypass","url":"https://www.exploit-db.com/exploits/27755","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/webapps/27755.txt","file":"exploits/windows/webapps/27755.txt","published":"2013-08-21","added":"2013-08-21","updated":"2013-08-21","author":"Scott Buckel","type":"webapps","platform":"windows","port":null,"verified":false,"codes":["CVE-2013-0632","OSVDB-89096"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":24946,"kind":"exploit","title":"Adobe ColdFusion APSB13-03 - Remote Multiple Vulnerabilities (Metasploit)","url":"https://www.exploit-db.com/exploits/24946","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/24946.rb","file":"exploits/multiple/remote/24946.rb","published":"2013-04-10","added":"2013-04-10","updated":"2017-11-16","author":"Metasploit","type":"remote","platform":"multiple","port":null,"verified":true,"codes":["CVE-2013-0632","CVE-2013-0629","CVE-2013-0625","OSVDB-89096","OSVDB-88890","OSVDB-88889"],"tags":"Metasploit Framework (MSF)","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 24 March 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"http://www.adobe.com/support/security/advisories/apsa13-01.html","tags":["Mitigation","Vendor Advisory"],"source":"psirt@adobe.com"},{"url":"http://www.adobe.com/support/security/bulletins/apsb13-03.html","tags":["Broken Link","Vendor Advisory"],"source":"psirt@adobe.com"},{"url":"http://www.exploit-db.com/exploits/30210","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"psirt@adobe.com"},{"url":"http://www.adobe.com/support/security/advisories/apsa13-01.html","tags":["Mitigation","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.adobe.com/support/security/bulletins/apsb13-03.html","tags":["Broken Link","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.exploit-db.com/exploits/30210","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0632","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-0632","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}