{"id":"CVE-2013-0632","kind":"vulnerability","aliases":["CVE-2013-0632"],"related":[],"title":"Adobe ColdFusion: Adobe ColdFusion Authentication Bypass Vulnerability","description":"administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.","summary":"Authentication bypass in ColdFusion's administrator.cfc: an attacker logs in to the RDS component with the default empty password and uses that session to reach the Administrator interface, possibly leading to code execution. Adobe confirmed exploitation in the wild in January 2013 and it is on CISA KEV. Affects ColdFusion 10, 9.0.2, 9.0.1 and 9.0 on Windows, macOS and UNIX. ColdFusion 8 and earlier get no patch.","severity":"critical","cvss":10.0,"epss":0.93691,"exploited":true,"exploited_at":"2022-03-03T00:00:00+00:00","products":[{"name":"Adobe ColdFusion","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Adobe ColdFusion","fixed":["APSB13-03 hotfix"],"affected":"10, 9.0.2, 9.0.1, 9.0 (ColdFusion 8 and earlier also exposed, unpatched)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-coldfusion","auth-bypass","exploited","rds","runtime","self-hosted"],"not_affected_if":["admin-paths-blocked","managed-hosting","patched-version","rds-password-set"],"how_to_check":"Check the version in ColdFusion Administrator (System Information) or with server.coldfusion.productversion. Treat any ColdFusion 9.0 to 9.0.2 or 10 server without the APSB13-03 hotfix as exposed. Check whether /CFIDE/administrator, /CFIDE/adminapi and /CFIDE/componentutils are reachable from the internet, and whether RDS has no password set. Look for files and scheduled tasks of unknown origin in CFIDE, CFIDE/adminapi or the webroot. Adobe's examples are h.cfm, i.cfm, h9.cfm, r.cfm, adss.cfm and fusebox.cfm.","fix":"Apply the APSB13-03 security hotfix for your version (see Adobe's technote helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix-apsb13-03.html), then move to a currently supported ColdFusion release. Also: set a separate RDS username and password and disable RDS if unused. Block external access to /CFIDE/administrator, /CFIDE/adminapi and /CFIDE/componentutils. Restrict access to the Administrator interface. ColdFusion 8 and earlier have no patch, so these mitigations are the only option.","status":"resolved","published_at":"2013-01-17T00:55:01+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:26:20+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-10-23T21:26:20Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor updates for Adobe ColdFusion per Adobe's advisory; the fixed versions are not stated in the sources.","reach":"internet","impact":"high","summary":"Adobe ColdFusion has an authentication bypass that lets an unauthenticated user gain administrative access. It is on CISA's known-exploited list with an EPSS score of 0.937, so attacks are likely in progress.","category":"runtime","who_cares":["adobe-coldfusion","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker gains administrator access to the ColdFusion server","analyst_note":"Find the affected and fixed ColdFusion versions and the detection method in Adobe's security bulletin for CVE-2013-0632 (the sources give none).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","patched-version"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000465,"input_tokens":2828,"output_tokens":364,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected and fixed ColdFusion versions and the detection method in Adobe's security bulletin for CVE-2013-0632 (the sources give none).","search":"'-0632':10A,13A '-2013':9A,12A '10':80B,105C '2013':71B,146C '8':91B '9.0':84B,101C '9.0.1':82B,102C '9.0.2':81B,103C 'access':134C 'administr':56B,136C 'administrator.cfc':35B,97C 'adob':1A,3A,19B,63B,99C 'adobe':14A,16A 'adobe-coldfus':18B 'affect':78B 'allow':106C 'arbitrari':115C 'attack':37B,108C 'auth':22B 'auth-bypass':21B 'authent':5A,30B,111C 'bypass':6A,23B,31B,110C 'cisa':76B 'code':61B,116C 'coldfus':2A,4A,20B,33B,79B,90B,100C 'coldfusion':15A,17A 'compon':43B,123C 'confirm':64B 'cve':8A,11A 'default':46B,126C 'earlier':93B 'empti':47B,127C 'execut':62B,114C 'exploit':24B,65B,140C 'get':94B 'host':29B 'interfac':57B,138C 'januari':70B,145C 'kev':77B 'lead':59B 'leverag':130C 'log':38B,118C 'maco':87B 'password':48B,128C 'patch':96B 'possibl':58B,113C 'rds':25B,42B,122C 'reach':54B 'remot':107C 'runtim':26B 'self':28B 'self-host':27B 'session':52B,132C 'unix':89B 'use':50B,124C 'vulner':7A 'web':137C 'wild':68B,143C 'window':86B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2013-01-17T00:55:01+00:00","kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2013-0632","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0632","severity":null,"published_at":"2022-03-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T19:35:25+00:00","note":null},{"source":"epss","external_id":"CVE-2013-0632","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-0632","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2013-0632:80","url":null,"severity":null,"published_at":"2026-10-23T21:27:04+00:00","modified_at":"2026-10-23T21:27:04+00:00","first_seen_at":"2026-10-23T21:27:04+00:00","fetched_at":"2026-10-23T21:27:04+00:00","note":"Read Adobe APSB13-03 (archived copy; live Adobe page is now a JS shell) and APSA13-01, plus NVD. Affects CF 10, 9.0.2, 9.0.1, 9.0. Fix is a hotfix, not a version number; hotfix KB page did not load, so exact hotfix file unknown. No public PoC link found."},{"source":"nvd","external_id":"CVE-2013-0632","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0632","severity":null,"published_at":"2013-01-17T00:55:01+00:00","modified_at":"2026-06-16T23:49:48+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":1021,"url":"https://web.archive.org/web/2013/http://www.adobe.com/support/security/bulletins/apsb13-03.html","title":"Adobe APSB13-03 Security update: Hotfix available for ColdFusion (archived)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1022,"url":"https://www.adobe.com/support/security/advisories/apsa13-01.html","title":"Adobe APSA13-01 Security Advisory for ColdFusion","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1023,"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0632","title":"NVD CVE-2013-0632","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}