9.8Crítica
KEV
CVE-2013-0632Adobe ColdFusion Authentication Bypass Vulnerability
Explotación conocida — Adobe ColdFusion Authentication Bypass Vulnerability
CISA confirmó el 03.03.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 24.03.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-0632
Descripción
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.
Debilidad (CWE):
CWE-276
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| adobe | coldfusion | 9.0 |
Referencias y parches
- 30210 exploitExploitThird Party AdvisoryVDB Entry
- http://www.adobe.com/support/security/bulletins/apsb13-03.html Broken LinkVendor Advisory
- http://www.adobe.com/support/security/advisories/apsa13-01.html MitigationVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0632 US Government Resource
Coincidencias CPE (NVD) (4)
cpe:2.3:a:adobe:coldfusion:9.0:*:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:9.0.1:*:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:9.0.2:*:*:*:*:*:*:*cpe:2.3:a:adobe:coldfusion:10.0:*:*:*:*:*:*:*