CVE-2013-3336: Adobe ColdFusion arbitrary file read via unspecified vectors

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated remote file read with public exploit code and very high EPSS, though the CVSS base score is only 5.0 and the record lacks technical detail.

What it is

Adobe ColdFusion 9.0, 9.0.1, 9.0.2 and 10 contain an unspecified vulnerability that lets remote attackers read arbitrary files. The flaw is remotely reachable without authentication, so exposed ColdFusion servers can leak configuration files, credentials and source code. The record gives no root cause, affected component or fixed version detail.

Impact

An attacker can read arbitrary files on the server, exposing configuration data, credentials and application source. There is no integrity or availability impact per the CVSS vector; the loss is confidentiality only.

Attack surface

Reachable over the network (AV:N) with no authentication (Au:N) and no user interaction, per the CVSS 2.0 vector. The description does not identify the specific endpoint or request used, so the exact entry point is unknown.

Exploitation

Not listed in CISA KEV, but EPSS is 0.74265 (99.5th percentile), indicating a high modeled likelihood of exploitation. A public Exploit-DB entry (25305) is referenced, so exploit code is publicly available.

What to do

• Apply the Adobe security bulletin APSB13-13 update for ColdFusion 9.x and 10, or upgrade to a supported release.
• Restrict network access to ColdFusion administrative and application ports to trusted hosts only.
• Run the ColdFusion service with least privilege and limit its read access to sensitive files and directories.
• Review the server for exposed configuration, credential and source files and rotate any secrets that may have been readable.

Detection

• Monitor web and ColdFusion logs for anomalous requests targeting file paths or traversal patterns.
• Alert on unexpected reads of ColdFusion configuration files, password files or application source by the service account.
• Use file integrity and access monitoring on sensitive directories to catch out-of-pattern reads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.