administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.
References
| Link | Resource |
|---|---|
| http://www.adobe.com/support/security/advisories/apsa13-01.html | Mitigation Vendor Advisory |
| http://www.adobe.com/support/security/bulletins/apsb13-03.html | Broken Link Vendor Advisory |
| http://www.exploit-db.com/exploits/30210 | Exploit Third Party Advisory VDB Entry |
| http://www.adobe.com/support/security/advisories/apsa13-01.html | Mitigation Vendor Advisory |
| http://www.adobe.com/support/security/bulletins/apsb13-03.html | Broken Link Vendor Advisory |
| http://www.exploit-db.com/exploits/30210 | Exploit Third Party Advisory VDB Entry |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0632 |
Configurations
Configuration 1 (hide)
|
History
22 Oct 2025, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Oct 2025, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Oct 2025, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2013-01-17 00:55
Updated : 2025-10-22 01:15
NVD link : CVE-2013-0632
Mitre link : CVE-2013-0632
CVE.ORG link : CVE-2013-0632
JSON object : View
Products Affected
adobe
- coldfusion
CWE
CWE-276
Incorrect Default Permissions