{"schemaVersion":3,"id":"CVE-2013-0632","aliases":[],"status":"published","duplicateOf":null,"title":"Adobe ColdFusion Authentication Bypass Vulnerability","description":"administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.","dates":{"published":"2013-01-17T00:00:00.000Z","modified":"2025-10-22T00:05:44.628Z","reserved":null,"kevAdded":["2022-03-03T00:00:00.000Z"],"kevDue":["2022-03-24T00:00:00.000Z"]},"cvss":{"headline":{"score":10,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":10,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.93603,"percentile":0.99843,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.93603},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.93691,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.93691,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.93691,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.93691,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.93603,"percentile":0.99843}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.93603,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.93603,"percentile":0.99843}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-03-03T00:00:00.000Z","dueDate":"2022-03-24T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Adobe ColdFusion Authentication Bypass Vulnerability","description":"An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2013-0632","label":"nvd.nist.gov/vuln/detail/CVE-2013-0632"}],"vendor":"Adobe","product":"ColdFusion","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-03-03T00:00:00.000Z","dueDate":"2022-03-24T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Adobe ColdFusion Authentication Bypass Vulnerability","description":"An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2013-0632","label":"nvd.nist.gov/vuln/detail/CVE-2013-0632"}],"vendor":"Adobe","product":"ColdFusion","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"30210","name":"Adobe ColdFusion 9 - Administrative Authentication Bypass (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/30210","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/30210.rb","codes":["CVE-2013-0632"]},"metasploit":null},{"id":"24946","name":"Adobe ColdFusion APSB13-03 - Remote Multiple Vulnerabilities (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/24946","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/24946.rb","codes":["CVE-2013-0632","CVE-2013-0629","CVE-2013-0625","OSVDB-89096","OSVDB-88890","OSVDB-88889"]},"metasploit":null},{"id":"27755","name":"Adobe ColdFusion 9 - Administrative Authentication Bypass","source":"exploit-database","url":"https://www.exploit-db.com/exploits/27755","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":null,"platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"webapps","platform":"windows","file":"exploits/windows/webapps/27755.txt","codes":["CVE-2013-0632","OSVDB-89096"]},"metasploit":null},{"id":"MSF_EXPLOIT_MULTI_HTTP_COLDFUSION_RDS_AUTH_BYPASS","name":"Adobe ColdFusion RDS Authentication Bypass","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/multi/http/coldfusion_rds_auth_bypass.rb","maturity":"weaponized","reliabilityScore":0.8333333333333334,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/multi/http/coldfusion_rds_auth_bypass","rank":"500","rankName":"great","postAuth":false,"check":true,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":4,"weaknesses":[{"id":"CWE-276","name":"Incorrect Default Permissions","description":"During installation, installed file permissions are set to allow anyone to modify those files.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/276.html"}],"affected":[{"vendor":"adobe","product":"coldfusion","name":"coldfusion","label":"coldfusion","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"9.0","noFixRecorded":false,"fixedIn":null},{"text":"9.0.1","noFixRecorded":false,"fixedIn":null},{"text":"9.0.2","noFixRecorded":false,"fixedIn":null},{"text":"10.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"9.0 | 9.0.1 | 9.0.2 | 10.0","eol":{"isEol":true,"eolDate":"2017-05-16T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"10","label":"10","eolFrom":"2017-05-16T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"10.0.23.302580"},"product":{"name":"coldfusion","label":"Adobe ColdFusion","category":"server-app"}},"hubHref":"/vendor/adobe/coldfusion"}],"affectedCount":1,"eol":{"hasEol":true,"count":1},"references":[{"url":"http://www.exploit-db.com/exploits/30210","label":"www.exploit-db.com/exploits/30210","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb13-03.html","label":"www.adobe.com/support/security/bulletins/apsb13-03.html","hostname":"www.adobe.com","tags":["X Refsource CONFIRM","Broken Link","Vendor Advisory"]},{"url":"http://www.adobe.com/support/security/advisories/apsa13-01.html","label":"www.adobe.com/support/security/advisories/apsa13-01.html","hostname":"www.adobe.com","tags":["X Refsource CONFIRM","Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0632","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0632","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2013-01-17T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-03-03T00:00:00.000Z","label":"Added to CISA KEV","detail":"Adobe ColdFusion Authentication Bypass Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-03-24T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-22T00:05:44.628Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T06:05:02.301Z","stale":false,"partial":false}}