peter bassill · operator
$ cve CVE-2010-2861 JSON

CVE-2010-2861 KEV EXPLOIT

9.8
CRITICAL · CVSS 3.1 · EPSS 99.7% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-04-15.

Description

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS99.72% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-22
On CISA KEVyes — remediate by 2022-04-15
Public exploityes
Published2010-08-11
Last modified2026-08-14

CISA KEV

NameAdobe ColdFusion Directory Traversal Vulnerability
Added2022-03-25
Due2022-04-15
Vendor / productAdobe / ColdFusion
Ransomware useknown

Affected (1)

VendorProduct
adobecoldfusion

Public exploits

SourceTitleDate
exploit-dbAdobe ColdFusion - Directory Traversal (Metasploit)2011-03-16
exploit-dbAdobe ColdFusion - Directory Traversal2010-08-14

References

→ the Explorer  ·  watch your stack  ·  NVD