Adobe · ColdFusion

CVE-2013-0632

Adobe ColdFusion Authentication Bypass Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 93%

What it is

administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.

CISA: An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: March 24, 2022

Added to the CISA list: March 3, 2022
Published: January 17, 2013
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 93% in the top 0.2% of all known vulnerabilities
Weakness: CWE-200
More details: NVD · CVE.org · CISA

All references (3)

More exploited flaws from Adobe

Added	Vulnerability	Product	Severity	Attack chance
Jul 7, 2026	Path TraversalCVE-2026-48282	ColdFusion	Critical 10.0	42%
Feb 24, 2025	DeserializationCVE-2017-3066	ColdFusion	Critical 9.8	91%
Dec 16, 2024	Improper Access ControlCVE-2024-20767	ColdFusion	High 7.4	99%
Jan 8, 2024	Deserialization of Untrusted DataCVE-2023-29300used by ransomware	ColdFusion	Critical 9.8	>99.9%
Jan 8, 2024	Deserialization of Untrusted DataCVE-2023-38203used by ransomware	ColdFusion	Critical 9.8	97%
Aug 21, 2023	Deserialization of Untrusted DataCVE-2023-26359	ColdFusion	Critical 9.8	17%
Jul 20, 2023	Improper Access ControlCVE-2023-29298	ColdFusion	High 7.5	99.8%
Jul 20, 2023	Improper Access ControlCVE-2023-38205	ColdFusion	High 7.5	99.8%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.