CVE-2013-0625
Adobe ColdFusion Authentication Bypass Vulnerability
Published Jan 8, 2013 · updated Jun 16, 2026 · adobe coldfusion
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.
Timeline
Detection, updates, and resolution for this record.
Jan 8, 2013 · Catalog
Detected
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.
Mar 7, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Sep 7, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.
Required action
Apply updates per vendor instructions.
CISA due date Sep 7, 2022
Affected
- cpe adobe/coldfusion9.0
- cpe adobe/coldfusion9.0.1
- cpe adobe/coldfusion9.0.2
- vendor Adobe ColdFusionversion unspecified
Sources
- CISA KEVCVE-2013-0625
Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.
cisa.gov - CVE.orgCVE-2013-0625
Official CVE identifier
cve.org - FIRST EPSSCVE-2013-0625
30-day exploitation probability 93.8%
first.org - Exploit Database24946
Public archive entry. The exploit body is not stored here.
exploit-db.com - NIST NVDCVE-2013-0625
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.
nvd.nist.gov