Exploitation Summary
CVE-2013-3336 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 2 public exploits from researchers including HTP, HTP, sinn3r, nebulus, including a Metasploit module auxiliary/gather/coldfusion_pwd_props.
AI-analyzed exploit summary This exploit leverages a Local File Inclusion (LFI) vulnerability in Adobe ColdFusion 9/10 to disclose sensitive information, including absolute paths and credentials stored in password.properties. It performs fingerprinting and OS detection before attempting to extract credentials.
Description
Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files via unknown vectors.
Exploits (2)
This exploit leverages a Local File Inclusion (LFI) vulnerability in Adobe ColdFusion 9/10 to disclose sensitive information, including absolute paths and credentials stored in password.properties. It performs fingerprinting and OS detection before attempting to extract credentials.
This Metasploit module exploits a directory traversal vulnerability in ColdFusion to extract sensitive information such as password hashes from the 'password.properties' file. It targets ColdFusion 9 and 10 by leveraging a path traversal technique to access restricted files.