CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2013-0625

CVSS 9.8v3.1pub. 2013-01-09upd. 2026-04-21

Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Adobe Coldfusion

    APP
    Adobe
    9.09.0.19.0.2

  • Apple Mac Os X

    OS
    Apple
    all versions

  • Microsoft Windows

    OS
    Microsoft
    all versions

  • Opengroup Unix

    OS
    Opengroup
    all versions

CISA KEV — detailsi

Vendori
Adobe ↗
Producti
ColdFusion
Added to KEVi
March 7, 2022
Remediation deadline (US Federal)i
September 7, 2022(overdue)
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 7 września 2022
Tags
RCEAuth Bypass
CWE
References

Related vulnerabilities

CVE-2026-48282CRITICAL10.0⚠ KEVPL ✓same product

Adobe ColdFusion: Path Traversal umożliwiający zdalne wykonanie kodu (RCE)

CVE-2026-8398CRITICAL9.3⚠ KEVPL ✓same product

Atak na łańcuch dostaw DAEMON Tools Lite — trojanizacja instalatorów

CVE-2025-10585CRITICAL9.8⚠ KEVPL ✓same product

Type confusion w V8 (Google Chrome) — zdalne uszkodzenie sterty

CVE-2025-34028CRITICAL9.3⚠ KEVPL ✓same product

Commvault Command Center – nieuwierzytelniony RCE przez path traversal w ZIP

CVE-2024-7262CRITICAL9.3⚠ KEVPL ✓same product

Path Traversal w Kingsoft WPS Office — ładowanie dowolnej biblioteki Windows