CVE-2013-0632

administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - psirt@adobe.com

Published

2013-01-17

Last modified

2025-10-22

Known exploited (CISA KEV)

since 2022-03-03, action due 2022-03-24: Apply updates per vendor instructions.

Weaknesses

CWE-276

Affected products

• Coldfusion (Adobe)

References

• http://www.adobe.com/support/security/advisories/apsa13-01.html
• http://www.adobe.com/support/security/bulletins/apsb13-03.html
• http://www.exploit-db.com/exploits/30210
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0632