by Kastro
Paper/Archive/CVE-2013-0632

CVE-2013-0632

Adobe ColdFusion — Adobe ColdFusion Authentication Bypass Vulnerability

KEV · due 24 MarEPSS 93%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.8.998 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

exploitexploit-db.com/exploits/30210refadobe.com/support/security/bulletins/apsb13-03.htmlrefadobe.com/support/security/advisories/apsa13-01.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0632kevcisa.gov/known-exploited-vulnerabilities-catalog