CVE-2013-0632

CVE Database · CVE-2013-0632

CVE-2013-0632

· CRITICALAnalyzed

CVSS v3.1

9.8

EPSS

93.69%

Published

Jan 16, 2013

Modified

Apr 21, 2026

CISA Known Exploited Vulnerability

Added: 2022-03-03 · Due: 2022-03-24

Apply updates per vendor instructions.

Public PoC / Exploit (4)

All weaponized →

Exploit-DBAdobe ColdFusion 9 - Administrative Authentication Bypass (Metasploit)Exploit-DBAdobe ColdFusion APSB13-03 - Remote Multiple Vulnerabilities (Metasploit)Exploit-DBAdobe ColdFusion 9 - Administrative Authentication Bypass TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-276CWE-276

Affected Products (4)

adobe · coldfusionvulnerable

References (7)

http://www.adobe.com/support/security/advisories/apsa13-01.html

MitigationVendor Advisory

http://www.adobe.com/support/security/bulletins/apsb13-03.html

Broken LinkVendor Advisory

http://www.exploit-db.com/exploits/30210

ExploitThird Party AdvisoryVDB Entry

http://www.adobe.com/support/security/advisories/apsa13-01.html

MitigationVendor Advisory

http://www.adobe.com/support/security/bulletins/apsb13-03.html

Broken LinkVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs