CVE-2013-0629: Adobe ColdFusion Directory Traversal Vulnerability
Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013.
Other sources
Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure a password is configured for Adobe ColdFusion — set a non-empty password so the application is not left without a password, preventing unauthorized access to restricted directories.
Adobe ColdFusion password configured = configured (non-empty)
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0629?
CVE-2013-0629 is considered a critical vulnerability due to its potential for unauthorized access to restricted directories.
How do I fix CVE-2013-0629?
To fix CVE-2013-0629, ensure that strong passwords are configured for all ColdFusion installations.
Which versions of Adobe ColdFusion are affected by CVE-2013-0629?
CVE-2013-0629 affects Adobe ColdFusion versions 9.0, 9.0.1, 9.0.2, and 10.0.
What type of vulnerability is CVE-2013-0629?
CVE-2013-0629 is a directory traversal vulnerability that can allow attackers access to restricted directories.
Can CVE-2013-0629 be exploited remotely?
Yes, CVE-2013-0629 can be exploited remotely when proper password protections are not configured.