{"id":"CVE-2013-0632","published":"2013-01-17T00:55:01Z","modified":"2026-06-16T23:49:48Z","title":"Adobe ColdFusion Authentication Bypass Vulnerability","vendor":"Adobe","product":"ColdFusion","tier":"core","eol":null,"description":{"text":"administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an authentication bypass in the RDS component of Adobe ColdFusion, specifically in administrator.cfc. An attacker with remote network access can log in to RDS using the default empty password and use the resulting session to reach the administrative web interface, possibly leading to arbitrary code execution, with no authentication or user interaction required beyond reaching the service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:09:46Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.93076,"percentile":0.99832,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-0632","provenance":"source"},"vulncheckKev":{"dateAdded":"2013-01-17","exploitedFirstSeen":"2013-01-17","ransomware":false,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0632","date":"2013-01-17"},{"url":"https://www.adobe.com/support/security/advisories/apsa13-01.html","date":"2013-12-04"},{"url":"https://cisa.gov/news-events/alerts/2015/04/29/top-30-targeted-high-risk-vulnerabilities","date":"2016-09-29"},{"url":"https://www.us-cert.gov/ncas/alerts/TA15-119A","date":"2016-09-29"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-03"},{"url":"https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/files/2026/03/2025YiR-report.pdf","date":"2026-03-23"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-276","name":"Incorrect Default Permissions"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"http://www.adobe.com/support/security/advisories/apsa13-01.html","tags":["Mitigation","Vendor Advisory"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb13-03.html","tags":["Broken Link","Vendor Advisory"]},{"url":"http://www.exploit-db.com/exploits/30210","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.adobe.com/support/security/advisories/apsa13-01.html","tags":["Mitigation","Vendor Advisory"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb13-03.html","tags":["Broken Link","Vendor Advisory"]},{"url":"http://www.exploit-db.com/exploits/30210","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0632","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev","ctid-cve"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass; CTID attack_to_cve (Phase 1)","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by logging in with an empty password on a misconfigured system. ","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2013-0643","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-0643","exploited":true,"exploitedSince":"2022-03-03","provenance":"source"},"exploits":[{"id":24946,"url":"https://www.exploit-db.com/exploits/24946","title":"Adobe ColdFusion APSB13-03 - Remote Multiple Vulnerabilities (Metasploit)","type":"remote","platform":"multiple","date":"2013-04-10","verified":true,"provenance":"source"},{"id":27755,"url":"https://www.exploit-db.com/exploits/27755","title":"Adobe ColdFusion 9 - Administrative Authentication Bypass","type":"webapps","platform":"windows","date":"2013-08-21","verified":false,"provenance":"source"},{"id":30210,"url":"https://www.exploit-db.com/exploits/30210","title":"Adobe ColdFusion 9 - Administrative Authentication Bypass (Metasploit)","type":"remote","platform":"multiple","date":"2013-12-11","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2013-04-10"},"metasploit":[{"name":"Adobe ColdFusion RDS Authentication Bypass","module":"exploit/multi/http/coldfusion_rds_auth_bypass","type":"exploit","disclosureDate":"2013-08-08","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/coldfusion_rds_auth_bypass.rb"}],"first":{"date":"2013-04-10","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/24946"},"provenance":"source"},"exploitRefs":["http://www.exploit-db.com/exploits/30210"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"}],"timeline":[{"date":"2013-01-17","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0632","provenance":"source"},{"date":"2013-01-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2013-0632","provenance":"source"},{"date":"2013-04-10","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-24946); later: Metasploit 2013-08-08","url":"https://www.exploit-db.com/exploits/24946","provenance":"source"},{"date":"2022-03-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-0643","provenance":"source"}],"speed":{"daysToPublicExploit":83,"firstExploitFrom":"Exploit-DB","daysToKev":3332},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 5033 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9983"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 3 Exploit-DB entries; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-adobe-coldfusion-cwe-200"}}