CVE-2013-0632

{"id": "CVE-2013-0632", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2013-01-17T00:55:01.200", "references": [{"url": "http://www.adobe.com/support/security/advisories/apsa13-01.html", "tags": ["Mitigation", "Vendor Advisory"], "source": "psirt@adobe.com"}, {"url": "http://www.adobe.com/support/security/bulletins/apsb13-03.html", "tags": ["Broken Link", "Vendor Advisory"], "source": "psirt@adobe.com"}, {"url": "http://www.exploit-db.com/exploits/30210", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "psirt@adobe.com"}, {"url": "http://www.adobe.com/support/security/advisories/apsa13-01.html", "tags": ["Mitigation", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.adobe.com/support/security/bulletins/apsb13-03.html", "tags": ["Broken Link", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.exploit-db.com/exploits/30210", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013."}, {"lang": "es", "value": "En el archivo administrator.cfc en ColdFusion de Adobe versiones 9.0, 9.0.1, 9.0.2 y 10, permite a los atacantes remotos omitir la autenticaci\u00f3n y posiblemente ejecutar c\u00f3digo arbitrario mediante el inicio de sesi\u00f3n en el componente RDS con el valor de contrase\u00f1a vac\u00eda por defecto y aprovechando esta sesi\u00f3n para acceder a la interfaz web administrativa, como se explot\u00f3 \u201cin the wild\u201d en Enero de 2013."}], "lastModified": "2024-11-21T01:47:54.340", "cisaActionDue": "2022-03-24", "cisaExploitAdd": "2022-03-03", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:coldfusion:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "113431FB-E4BE-4416-800C-6B13AD1C0E92"}, {"criteria": "cpe:2.3:a:adobe:coldfusion:9.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FBC38B4-D957-4645-BA96-E99975271482"}, {"criteria": "cpe:2.3:a:adobe:coldfusion:9.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD9AAAA5-231A-43BE-AD00-0918F0C9F90C"}, {"criteria": "cpe:2.3:a:adobe:coldfusion:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FAE2BA4-7CD9-4CBD-9D77-56D591FBDB24"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "Adobe ColdFusion Authentication Bypass Vulnerability"}