Critical severity · published Aug 11, 2010
CVE-2010-2861
Adobe ColdFusion Directory Traversal Vulnerability
RansomwareIn wildKEV
9.8
CVSS
99.7%
EPSS
Yes
On KEV
Description
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.7% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 25, 2022
Federal remediation dueApr 15, 2022
Ransomware campaign useKnown
Affected products
Which versions
CO
ColdFusion · Adobe
through 9.0.1 · source: NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-2861
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-2861
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Broken Link
http://securityreason.com/securityalert/8137
Broken Link
http://securityreason.com/securityalert/8148
Not Applicable
http://www.adobe.com/support/security/bulletins/apsb10-18.html
Exploit
http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/
Broken Link
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07
US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2861
More from ColdFusion
10.0
CVE-2026-48282
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
9.8
CVE-2023-38203
Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE
9.8
CVE-2023-29300
Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
9.8
CVE-2023-26359
Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
9.8
CVE-2018-15961
Adobe ColdFusion Unrestricted File Upload Vulnerability