CVE-2013-0629

Adobe ColdFusion contains a directory traversal vulnerability (CWE-264) that permits an unauthorized user to access restricted directories outside the paths the application is meant to expose. It is triggered when an attacker submits crafted input containing directory traversal sequences to a ColdFusion server, bypassing the access controls that normally confine requests to allowed directories. Successful exploitation can allow an attacker to read files in restricted directories, potentially including configuration files containing credentials, enabling further compromise of the host. Any organization running Adobe ColdFusion servers is affected, with the highest risk on servers exposed to the internet. The flaw is confirmed exploited in the wild: it was added to CISA's KEV catalog on 2022-03-07 (federal agencies are required to patch per vendor instructions), EPSS assigns a 65.9% probability of exploitation within 30 days (99th percentile), ransomware association is unknown, and no public PoC is known.

What to do: Inventory all Adobe ColdFusion installations — prioritizing internet-facing servers — and apply the applicable Adobe update per vendor instructions, which is a mandatory federal remediation under the KEV listing. Until patched, restrict network access to ColdFusion servers and monitor access logs for directory-traversal patterns. Because in-the-wild exploitation is confirmed, review affected servers for unauthorized directory/file access and exposed credentials.