CVE-2013-0632criticalunder attackCWE-276

CVE-2013-0632

Published · Updated

Follow this CVE+ Monitor ColdFusion

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 93%
from disclosure to weapon83 days
Published on NVDJan 17
1st PoC+83d
metasploit+203d
CISA KEV+3332d
Action required by CISAfederal deadline: 2022-03-24

Apply updates per vendor instructions.

In short

Adobe ColdFusion's administrative interface could be accessed without a password through the RDS component, allowing attackers to take full control of the server. This was actively exploited by hackers in early 2013.

Technical detail

The RDS (Remote Development Services) component in ColdFusion 9.0–10 accepts connections with an empty default password, enabling unauthenticated access to the administrator.cfc interface. An attacker can establish an RDS session and leverage it to access the administrative web interface, bypassing authentication and potentially executing arbitrary code with administrative privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.