CVE-2010-2861
Adobe ColdFusion Directory Traversal Vulnerability
Description
CVE-2010-2861 is a critical path traversal vulnerability affecting Adobe ColdFusion (versions <= 9.0.1). A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files. This vulnerability has been associated with ransomware campaigns, heightening its risk profile. CISA has added CVE-2010-2861 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 94.28% (99.9th percentile), this vulnerability has a very high probability of being exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | coldfusion | <= 9.0.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://securityreason.com/securityalert/8137(Broken Link)
- http://securityreason.com/securityalert/8148(Broken Link)
- http://www.adobe.com/support/security/bulletins/apsb10-18.html(Not Applicable, Vendor Advisory)
- http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/(Exploit)
- http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2861(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Path Traversal (also known as Directory Traversal) is a vulnerability that occurs when software uses external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory, but fails to properly neutralize special elements such as ".." and "/" that can cause the pathname to resolve to a location outside of the restricted directory. Attackers exploit this weakness by manipulating file path references using sequences like "../" to escape the intended directory and access arbitrary files on the system. In the case of CVE-2010-2861, this weakness manifests in Adobe ColdFusion where a directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2010-2861 poses a critical threat to organizations running Adobe ColdFusion, with a CVSS score of 9.8 reflecting maximum impact across confidentiality, integrity, and availability. Successful exploitation can fully compromise the confidentiality, integrity, and availability of affected systems. Attackers can access sensitive data, modify system configurations or data, and disrupt service availability. The documented association with ransomware campaigns makes this vulnerability particularly dangerous, as threat actors actively leverage it for initial access or privilege escalation in ransomware operations.
Exploit Maturity
CVE-2010-2861 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming real-world exploitation. The EPSS score of 94.28% (99.9th percentile) places it among the most likely vulnerabilities to be exploited, reflecting widespread and active exploitation activity. Public exploit code is available, lowering the barrier for attackers and increasing the urgency to patch. This vulnerability has been linked to ransomware campaigns, indicating that well-resourced threat actors are actively incorporating it into their attack chains.
Remediation
- Apply vendor patches immediately as required by CISA KEV: Apply updates per vendor instructions. Upgrade Adobe ColdFusion from affected versions (<= 9.0.1) to the latest patched release.
- If immediate patching is not possible, restrict network access to the affected ColdFusion service using firewall rules, ACLs, or network segmentation to limit exposure to trusted networks only.
- Given the ransomware association, ensure endpoint detection and response (EDR) solutions are active on all affected systems and monitor for indicators of compromise including unusual process execution, file encryption activity, and lateral movement.
- Evaluate whether affected Adobe ColdFusion deployments are still within vendor support. End-of-life systems should be prioritized for migration to supported alternatives.
- Review and update your organization's vulnerability management process to ensure CISA KEV entries with a remediation deadline of 2022-04-15 are addressed within the required timeframe.
Technical Details
CVE-2010-2861 is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Adobe ColdFusion in versions <= 9.0.1. A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files. The vulnerability is exploitable remotely over the network, with low attack complexity, requiring no prior authentication. The CVSS 3.1 base score of 9.8 (CRITICAL) reflects high confidentiality impact, high integrity impact, and high availability impact.
Frequently Asked Questions
Is CVE-2010-2861 being actively exploited?
Yes. CVE-2010-2861 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.28% (99.9th percentile) indicates a very high probability of exploitation. Public exploit code is available, further increasing the risk. This vulnerability has also been associated with ransomware campaigns.
What products are affected by CVE-2010-2861?
CVE-2010-2861 primarily affects Adobe ColdFusion. The affected versions include <= 9.0.1. Organizations should check whether any instances of the affected software are running in their environment.
How do I fix CVE-2010-2861?
Apply updates per vendor instructions. Specifically, upgrade from the affected versions (<= 9.0.1) to the latest patched release from Adobe. As an interim measure, restrict network access to the affected service to trusted networks only.
How severe is CVE-2010-2861?
CVE-2010-2861 has a CVSS 3.1 score of 9.8, rated CRITICAL. This critical rating reflects the vulnerability's potential for complete system compromise. The association with ransomware campaigns further elevates the operational risk posed by this vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.