CVE-2013-0632 administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the defaul...
CriticalCVSS 9.8
EPSS 93.1%
CISA KEV
added 2022-03-03 · due 2022-03-24
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.
CISA Known Exploited Vulnerability
- Date added
- 2022-03-03
- Due date (FCEB)
- 2022-03-24
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe coldfusion | = 9.0 | No fix listed |
| Adobe coldfusion | = 9.0.1 | No fix listed |
| Adobe coldfusion | = 9.0.2 | No fix listed |
| Adobe coldfusion | = 10.0 | No fix listed |
References
- www.adobe.com mitigation vendor-advisory
- www.adobe.com broken-link vendor-advisory
- 30210 exploit third-party-advisory vdb-entry
- www.cisa.gov government-resource us-government-resource