CVE-2010-2861

adobe coldfusion

Published 11 Aug 2010 · updated 2 Oct 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 25 Mar 2022, with a remediation deadline of 15 Apr 2022 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.

References

securityreason.com/securityalert/8137 · Broken Link
securityreason.com/securityalert/8148 · Broken Link
www.adobe.com/support/security/bulletins/apsb10-18.html · Not Applicable, Vendor Advisory
www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/ · Exploit
www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07 · Broken Link
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2861 · US Government Resource