module
Adobe ColdFusion RDS Authentication Bypass
| Disclosed |
|---|
| Aug 8, 2013 |
Disclosed
Aug 8, 2013
Description
Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote
attackers to bypass authentication using the RDS component. Due to
default settings or misconfiguration, its password can be set to an
empty value. This allows an attacker to create a session via the RDS
login that can be carried over to the admin web interface even though
the passwords might be different, and therefore bypassing authentication
on the admin web interface leading to arbitrary code execution. Tested
on Windows and Linux with ColdFusion 9.
attackers to bypass authentication using the RDS component. Due to
default settings or misconfiguration, its password can be set to an
empty value. This allows an attacker to create a session via the RDS
login that can be carried over to the admin web interface even though
the passwords might be different, and therefore bypassing authentication
on the admin web interface leading to arbitrary code execution. Tested
on Windows and Linux with ColdFusion 9.
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.