CVE-2013-0625: Adobe ColdFusion Authentication Bypass Vulnerability
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.
Other sources
Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure a password for the Adobe ColdFusion installation (ensure a non-empty password is set) to prevent authentication bypass that occurs when no password is configured.
Adobe ColdFusion password configured = set (non-empty)
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0625?
CVE-2013-0625 has a high severity rating due to its ability to allow remote attackers authentication bypass and potentially arbitrary code execution.
How do I fix CVE-2013-0625?
To fix CVE-2013-0625, ensure that a strong password is configured for Adobe ColdFusion and apply any relevant security updates provided by Adobe.
Which versions of Adobe ColdFusion are affected by CVE-2013-0625?
CVE-2013-0625 affects Adobe ColdFusion versions 9.0, 9.0.1, 9.0.2, and 10.0.
What are the potential consequences of CVE-2013-0625?
The potential consequences of CVE-2013-0625 include unauthorized access to the ColdFusion server and the possibility of executing arbitrary code.
Is there a workaround for CVE-2013-0625?
A workaround for CVE-2013-0625 is to immediately disable any ColdFusion services that do not require authentication until the issue is resolved.