CVE-2013-0632

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 16, 2026

Description

administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.adobe.com/support/security/advisories/apsa13-01.htmlMitigation, Vendor Advisory
http://www.adobe.com/support/security/bulletins/apsb13-03.htmlBroken Link, Vendor Advisory
http://www.exploit-db.com/exploits/30210Exploit, Third Party Advisory, VDB Entry
http://www.adobe.com/support/security/advisories/apsa13-01.htmlMitigation, Vendor Advisory
http://www.adobe.com/support/security/bulletins/apsb13-03.htmlBroken Link, Vendor Advisory
http://www.exploit-db.com/exploits/30210Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0632US Government Resource

Timeline

Published: Jan 17, 2013
Last modified: Jun 16, 2026
Added to CISA KEV: Mar 3, 2022
NVD status: Analyzed

Related CVEs from 2013