CVE-2013-0632

adobe coldfusion

Published 17 Jan 2013 · updated 16 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 3 Mar 2022, with a remediation deadline of 24 Mar 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.

References

www.adobe.com/support/security/advisories/apsa13-01.html · Mitigation, Vendor Advisory
www.adobe.com/support/security/bulletins/apsb13-03.html · Broken Link, Vendor Advisory
www.exploit-db.com/exploits/30210 · Exploit, Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0632 · US Government Resource