CVE-2013-0632 is a critical authentication bypass vulnerability affecting Adobe ColdFusion versions 9.0, 9.0.1, 9.0.2, and 10. It allows remote attackers to gain administrative access and potentially execute arbitrary code by exploiting a default empty password in the RDS component. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network with low complexity, leading to complete compromise of confidentiality, integrity, and availability. This CVE has been actively exploited in the wild since January 2013, with multiple Metasploit modules and ExploitDB entries publicly available, and has garnered significant community and media attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
9.0CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:9.0:*:*:*:*:*:*:* | ||
9.0.1CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:9.0.1:*:*:*:*:*:*:* | ||
9.0.2CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:9.0.2:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:a:adobe:coldfusion:10.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.