CVE-2013-0632

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 93,6%

Kerentanan Incorrect Default Permissions pada adobe coldfusion. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 3 Maret 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.

Rincian

Terbit di NVD

17 Januari 2013

Terakhir diubah

16 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-276: Incorrect Default Permissions

EPSS (30 hari)

93,6% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Adobe ColdFusion Authentication Bypass Vulnerability

Masuk KEV

3 Maret 2022

Tenggat CISA

24 Maret 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.adobe.com/support/security/advisories/apsa13-01.html mitigasi · advisory vendor
• http://www.adobe.com/support/security/bulletins/apsb13-03.html broken link · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0632 pemerintah AS
• http://www.exploit-db.com/exploits/30210 exploit · advisory pihak ketiga · vdb entry