{"id":"CVE-2013-0629","kind":"vulnerability","aliases":["CVE-2013-0629"],"related":[],"title":"Adobe ColdFusion: Adobe ColdFusion Directory Traversal Vulnerability","description":"Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Adobe ColdFusion has a directory traversal flaw that lets an unauthorized user reach restricted directories on the server. It is listed in CISA's Known Exploited Vulnerabilities catalog, so attacks have been seen in the wild.","severity":"high","cvss":7.5,"epss":0.65795,"exploited":true,"exploited_at":"2022-03-07T00:00:00+00:00","products":[{"name":"Adobe ColdFusion","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe","coldfusion","exploited","runtime","self-hosted"],"not_affected_if":["not-coldfusion"],"how_to_check":null,"fix":"Apply the updates per Adobe's vendor instructions; the specific fixed version is unknown from the sources.","status":"open","published_at":"2013-01-09T01:55:03+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:22:19+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:22:19Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates per Adobe's vendor instructions; the specific fixed version is unknown from the sources.","reach":"internet","impact":"medium","summary":"Adobe ColdFusion has a directory traversal flaw that lets an unauthorized user reach restricted directories on the server. It is listed in CISA's Known Exploited Vulnerabilities catalog, so attacks have been seen in the wild.","category":"runtime","who_cares":["coldfusion","adobe","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads files outside intended directories on the server","analyst_note":"Find the affected and fixed ColdFusion versions and the vendor advisory (Adobe APSB13-03) to fill in how_to_check and fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-coldfusion"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000456,"input_tokens":2826,"output_tokens":347,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0629':10A,13A '-2013':9A,12A 'access':72C 'action':78C 'adob':1A,3A,16B,23B,59C 'adobe':14A 'appli':79C 'attack':52B 'catalog':50B 'cisa':45B,76C 'coldfus':2A,4A,17B,24B,60C 'coldfusion':15A 'contain':61C 'could':67C 'cve':8A,11A 'directori':5A,27B,37B,63C,75C 'exploit':18B,48B 'flaw':29B 'host':22B 'instruct':83C 'known':47B 'let':31B 'list':43B 'per':81C 'permit':68C 'reach':35B 'requir':77C 'restrict':36B,74C 'runtim':19B 'seen':55B 'self':21B 'self-host':20B 'server':40B 'travers':6A,28B,64C 'unauthor':33B,70C 'updat':80C 'user':34B,71C 'vendor':82C 'vulner':7A,49B,65C 'wild':58B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2013-01-09T01:55:03+00:00","kev":{"dateAdded":"2022-03-07","dueDate":"2022-09-07","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2013-0629","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0629","severity":null,"published_at":"2022-03-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T19:35:25+00:00","note":null},{"source":"epss","external_id":"CVE-2013-0629","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-0629","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2013-0629","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0629","severity":null,"published_at":"2013-01-09T01:55:03+00:00","modified_at":"2026-06-16T23:49:47+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}