Paper/Archive/CVE-2010-2861

CVE-2010-2861

Adobe ColdFusion — Adobe ColdFusion Directory Traversal Vulnerability

KEV · due 15 Apr ransomware use EPSS 100%public exploit SSVC act CVSS 9.8

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 100.01.000 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADP7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: partial

References

refgnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861 refprocheckup.com/vulnerability_manager/vulnerabilities/pr10-07 refadobe.com/support/security/bulletins/apsb10-18.html writeupsecurityreason.com/securityalert/8137 writeupsecurityreason.com/securityalert/8148 refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2861 kevcisa.gov/known-exploited-vulnerabilities-catalog