Adobe ColdFusion Multiple Vulnerabilities (APSB13-03) (credentialed check)

critical Nessus Plugin ID 66526

Language:

Synopsis

A web-based application running on the remote Windows host is affected by multiple vulnerabilities.

Description

The version of Adobe ColdFusion running on the remote host is missing hotfixes that address the following vulnerabilities :

- An authentication bypass vulnerability exists that could allow an unauthorized user to gain administrative access. (CVE-2013-0625)

- A directory traversal vulnerability exists that could allow an unauthorized user to gain administrative access. (CVE-2013-0629)

- An unspecified information disclosure vulnerability exists that affects servers that have already been compromised. (CVE-2013-0631)

- Authentication bypass vulnerability exists that could allow an unauthorized user to gain administrative access. (CVE-2013-0632)

Solution

Apply the appropriate hotfixes referenced in Adobe security bulletin APSB13-03.

Plugin Details

Severity: Critical

ID: 66526

File Name: coldfusion_win_apsb13-03.nasl

Version: 1.13

Type: local

Agent: windows

Family: Windows

Published: 5/21/2013

Updated: 4/25/2023

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2013-0632

Vulnerability Information

CPE: cpe:/a:adobe:coldfusion

Required KB Items: SMB/coldfusion/instance

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/15/2013

Vulnerability Publication Date: 12/28/2012

CISA Known Exploited Vulnerability Due Dates: 3/24/2022, 9/7/2022

Exploitable With

Core Impact

Metasploit (Adobe ColdFusion 9 Administrative Login Bypass)

Reference Information

CVE: CVE-2013-0625, CVE-2013-0629, CVE-2013-0631, CVE-2013-0632

BID: 57164, 57165, 57166, 57330

Detections

Analytics