critical9.8Known exploitedPublic exploit code
CVE-2010-2861
Adobe ColdFusion Directory Traversal Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-03-25. Federal due date: 2022-04-15.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Adobe ColdFusion - Directory Traversal (Metasploit)2011-03-16 · remote · multiple · Verified
- Adobe ColdFusion - Directory Traversal2010-08-14 · remote · multiple · Verified
Impact
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Adobe | Coldfusion | through 9.0.1 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://securityreason.com/securityalert/8137
- http://securityreason.com/securityalert/8148
- http://www.adobe.com/support/security/bulletins/apsb10-18.html
- http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/
- http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2861