CVE-2010-2861

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 2, 2026

Description

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://securityreason.com/securityalert/8137Broken Link
http://securityreason.com/securityalert/8148Broken Link
http://www.adobe.com/support/security/bulletins/apsb10-18.htmlNot Applicable, Vendor Advisory
http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/Exploit
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07Broken Link
http://securityreason.com/securityalert/8137Broken Link
http://securityreason.com/securityalert/8148Broken Link
http://www.adobe.com/support/security/bulletins/apsb10-18.htmlNot Applicable, Vendor Advisory
http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/Exploit
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2861US Government Resource

Timeline

Published: Aug 11, 2010
Last modified: Oct 2, 2026
Added to CISA KEV: Mar 25, 2022
NVD status: Analyzed

Related CVEs from 2010

CVE-2010-28629.3Integer overflow in CoolType.dll in Adobe Reader 8.2.3 and 9.3.3, and Acrobat 9.3.3, allows remote attackers to execute arbitrary code via a CVE-2010-286310.0Adobe Shockwave Player before 11.5.8.612 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary cod CVE-2010-28649.3IML32.dll in Adobe Shockwave Player before 11.5.8.612 does not properly parse .dir files, which allows remote attackers to cause a denial of CVE-2010-28655.0Unspecified vulnerability in Adobe Shockwave Player before 11.5.8.612 allows attackers to cause a denial of service via unknown vectors.CVE-2010-28669.3Integer signedness error in the DIRAPI module in Adobe Shockwave Player before 11.5.8.612 allows remote attackers to cause a denial of servi CVE-2010-28679.3DIRAPIX.dll in Adobe Shockwave Player before 11.5.8.612 does not properly handle a certain return value associated with the rcsL chunk in a CVE-2010-28689.3IML32.dll in Adobe Shockwave Player before 11.5.8.612 does not properly parse .dir files, which allows remote attackers to cause a denial of CVE-2010-28699.3IML32.dll in Adobe Shockwave Player before 11.5.8.612 does not properly parse .dir files, which allows remote attackers to cause a denial of CVE-2010-28709.3DIRAPIX.dll in Adobe Shockwave Player before 11.5.8.612 does not properly validate a certain chunk size in the mmap chunk in a Director movi CVE-2010-28719.3Integer overflow in the 3D object functionality in Adobe Shockwave Player before 11.5.8.612 allows remote attackers to cause a denial of ser CVE-2010-28729.3Adobe Shockwave Player before 11.5.8.612 does not properly validate an offset value in the pami RIFF chunk in a Director movie, which allows CVE-2010-28739.3Adobe Shockwave Player before 11.5.8.612 does not properly validate offset values in the rcsL RIFF chunks of (1) .DIR and (2) .DCR Director