CVE-2013-0625criticalunder attackCWE-287

CVE-2013-0625

Published · Updated

Follow this CVE+ Monitor ColdFusion

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.8epss 94%
from disclosure to weapon91 days
Published on NVDJan 9
1st PoC+91d
CISA KEV+3344d
Action required by CISAfederal deadline: 2022-09-07

Apply updates per vendor instructions.

In short

Adobe ColdFusion 9.0 and early versions can be accessed without authentication if no password is set, allowing attackers to take complete control of the server and run malicious code.

Technical detail

ColdFusion 9.0–9.0.2 lacks proper authentication enforcement when administrative credentials are unconfigured, enabling remote unauthenticated access via unspecified vectors that lead to arbitrary code execution. This affects default or improperly initialized deployments and was actively exploited in January 2013.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.