CVE-2013-0625
Published 2013-01-09 · Updated 2026-06-16 · Source psirt@adobe.com
Summary
CVE-2013-0625 is a critical-severity (CVSS 9.8) vulnerability in Adobe ColdFusion. CISA added it to the Known Exploited Vulnerabilities catalog on March 7, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 7, 2022. CISA does not currently list it as used in ransomware campaigns. Adobe has 83 vulnerabilities in the KEV catalog, 11 of them linked to ransomware.
All 83 known-exploited Adobe vulnerabilities →Description
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Adobe — ColdFusion
Name: Adobe ColdFusion Authentication Bypass Vulnerability
Date added: 2022-03-07 · Due: 2022-09-07
Required action: Apply updates per vendor instructions.
References
- http://www.adobe.com/support/security/advisories/apsa13-01.html
- http://www.adobe.com/support/security/bulletins/apsb13-03.html
- http://www.securityfocus.com/bid/57164
- http://www.adobe.com/support/security/advisories/apsa13-01.html
- http://www.adobe.com/support/security/bulletins/apsb13-03.html
- http://www.securityfocus.com/bid/57164
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0625