CVE-2013-0625
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - psirt@adobe.com
- Published
- 2013-01-09
- Last modified
- 2025-10-22
- Known exploited (CISA KEV)
- since 2022-03-07, action due 2022-09-07: Apply updates per vendor instructions.
- Weaknesses
- CWE-287
Affected products
References
- http://www.adobe.com/support/security/advisories/apsa13-01.html
- http://www.adobe.com/support/security/bulletins/apsb13-03.html
- http://www.securityfocus.com/bid/57164
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0625
