Product:
Adobe ColdFusion
Summary
administrator.cfc in Adobe ColdFusion allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password. This vulnerability was exploited in the wild in January 2013, allowing unauthorized access to the administrative web interface.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2013-0632 |
Exploitation
To exploit this vulnerability, an attacker can connect to the RDS component of Adobe ColdFusion using the default empty password. Once authenticated, the attacker can leverage this session to access the administrative web interface, potentially executing arbitrary code and gaining full control over the affected system.
Affected Products
- Adobe ColdFusion 9.0: Vulnerable to authentication bypass and arbitrary code execution.
- Adobe ColdFusion 9.0.1: Same vulnerabilities as 9.0.
- Adobe ColdFusion 9.0.2: Same vulnerabilities as 9.0.
- Adobe ColdFusion 10: Same vulnerabilities as 9.0.
Mitigation
To mitigate this vulnerability, it is essential to apply updates as per the vendor’s instructions. Ensuring that the default empty password is changed and implementing additional security measures can also help protect against unauthorized access.