Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
7.5
CVSSv2

CVE-2010-2861

Published: 11/08/2010 Updated: 24/09/2013
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
VMScore: 782
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Subscribe to Coldfusion

Vulnerability Summary

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and previous versions allow remote malicious users to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

adobe coldfusion 9.0

adobe coldfusion 8.0.1

adobe coldfusion 8.0

adobe coldfusion

Exploits

Exploit DB: Adobe ColdFusion Directory Traversal
Proof of concept code that demonstrates the directory traversal vulnerability in Adobe ColdFusion ...
Exploit DB: Adobe ColdFusion - Directory Traversal
# Working GET request courtesy of carnal0wnage: # server/CFIDE/administrator/entercfm?locale=//////////ColdFusion8/lib/passwordproperties%00en # # LLsecurity added another admin page filename: "/CFIDE/administrator/entercfm" #!/usr/bin/python # CVE-2010-2861 - Adobe ColdFusion Unspecified Directory Traversal Vulnera ...
Exploit DB: Adobe ColdFusion - Directory Traversal (Metasploit)
## # $Id: coldfusion_traversalrb 11974 2011-03-16 01:38:16Z mc $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require 'msf/core' cla ...

Nmap Scripts

http-vuln-cve2010-2861

Executes a directory traversal attack against a ColdFusion server and tries to grab the password hash for the administrator user. It then uses the salt value (hidden in the web page) to create the SHA1 HMAC hash that the web server needs for authentication as admin. You can pass this value to the ColdFusion server as the admin without cracking the password hash.

nmap --script http-vuln-cve2010-2861 <host>

80/tcp open  http
| http-vuln-cve2010-2861:
|   VULNERABLE:
|   Adobe ColdFusion enter.cfm Traversal password.properties Information Disclosure
|     State: VULNERABLE
|     IDs:  CVE:CVE-2010-2861  OSVDB:67047
|     Description:
|       Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion
|       9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter
|     Disclosure date: 2010-08-10
|     Extra information:
|
|   ColdFusion8
|   HMAC: d6914bef568f8931d0c696cd5f7748596f97db5d
|   Salt: 1329446896585
|   Hash: 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8
|
|     References:
|       http://www.blackhatacademy.org/security101/Cold_Fusion_Hacking
|       http://www.nessus.org/plugins/index.php?view=single&id=48340
|       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2861
|       http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2861
|_      http://osvdb.org/67047


This script relies on the service being identified as HTTP or HTTPS. If the
ColdFusion server you run this against is on a port other than 80/tcp or 443/tcp
then use "nmap -sV" so that nmap discovers the port as an HTTP server.

Github Repositories

https://github.com/Odayex/BugBounty

+ UPDATE: Added my huge link of bookmarks / references ❤️ Do you have a million bookmarks saved? Do all of those bookmarks contain unique information? Github repos starred for later? Well this is a compilation of all of these resources into a single repo known as Cheatsheet-God No more need for bookmarked links No need to open a w

https://github.com/Striving-to-learn/Cybersecurity-Resources

Getting Started in Cybersecurity and Hacking Introduction Getting Started in Cybersecurity Entering the world of cybersecurity can feel overwhelming with numerous resources available This guide simplifies the journey for newcomers interested in technology, cybersecurity, ethical hacking, and bug bounty hunting Use the Table of Contents as your roadmap Begin with Getting Sta

https://github.com/bomergang/hackaas

+ UPDATE: Added my huge link of bookmarks / references ❤️ Do you have a million bookmarks saved? Do all of those bookmarks contain unique information? Github repos starred for later? Well this is a compilation of all of these resources into a single repo known as Cheatsheet-God No more need for bookmarked links No need to open a w

https://github.com/decal/CFMXDC

😰 ColdFusion MX Descrambler Code for installer.properties

CFMXDC Summary I re-wrote the bit-twiddling code that was the ColdFusion MX 6 administrator password encoding procedure after reverse engineering Java archives that the J2EE jrun application server was executing I used jad to decompile it, added my own driver code with a Main function and used the JDK to re-compile it again with javac Even though the two CLASS files are the

https://github.com/rutkai/pentest-bookmarks

A collection of penetration testing related sites

Hacking/Penetrating tester bookmark collection This is a collection of Pentest/Hacker sites It is originally created by Jason Haddix Blogs worth it What the title says There are a LOT of pentesting blogs, these are the ones i monitor constantly and value in the actual day to day testing work carnal0wnageblogspotcom/ wwwmcgrewsecuritycom/ wwwgnucit

https://github.com/cyberharsh/coldfusion2861

Adobe ColdFusion 文件读取漏洞（CVE-2010-2861） Adobe ColdFusion是美国Adobe公司的一款动态Web服务器产品，其运行的CFML（ColdFusion Markup Language）是针对Web应用的一种程序设计语言。 Adobe ColdFusion 8、9版本中存在一处目录穿越漏洞，可导致未授权的用户读取服务器任意文件。 环境搭建 执行如下命令启

https://github.com/djrod/CheatSheet_sec

+ UPDATE: Added my huge link of bookmarks / references ❤️ Do you have a million bookmarks saved? Do all of those bookmarks contain unique information? Github repos starred for later? Well this is a compilation of all of these resources into a single repo known as Cheatsheet-God No more need for bookmarked links No need to open a w

https://github.com/GSOC-SWAT/Cring-Ransomware

Cring-Ransomware RELATED IOCs, MITIGATION STEPS AND REFERENCE LINKS **Common Vulnerabilities and Exposures (CVE) ** (CVE-2018-13379 )Fortinet FortiOS, (CVE-2010-2861)-Adobe ColdFusion flaw IOCs(Indicators of compromise) SHA-256 f7d270ca0f2b4d21830787431f881cd004b2eb102cc3048c6b4d69cb775511c8 e687308cd4184e17c33fa9e44686e7d6a4d73adf65f7fb3cac9c4ad765b4ffdf 771a680f9a09a7a73ac267

https://github.com/umamahesh5689/hk-gitfiles

+ UPDATE: Added my huge link of bookmarks / references ❤️ Do you have a million bookmarks saved? Do all of those bookmarks contain unique information? Github repos starred for later? Well this is a compilation of all of these resources into a single repo known as Cheatsheet-God No more need for bookmarked links No need to open a w

https://github.com/sphinxs329/OSCP-Cheatsheet

+ UPDATE: Added my huge link of bookmarks / references ❤️ Do you have a million bookmarks saved? Do all of those bookmarks contain unique information? Github repos starred for later? Well this is a compilation of all of these resources into a single repo known as Cheatsheet-God No more need for bookmarked links No need to open a w

https://github.com/stefanpejcic/coldfusion

ColdFusion Cheat Sheet https://stefanpejcic.github.io/coldfusion/

CFML cheatsheet Master CF in no-time with these easy to remember (and free to use) CF cheat codes! You can open the html version on github pages or browse the code in markdown bellow Set variables Use cfset to create a variable (if it doesn't exist) and assign it a value You can also use it to call functions Current time &lt;cfset currentTime = now() /&gt;

https://github.com/OlivierLaflamme/Cheatsheet-God

Penetration Testing Reference Bank - OSCP / PTP & PTX Cheatsheet

+ UPDATE: Added my huge link of bookmarks / references ❤️ Do you have a million bookmarks saved? Do all of those bookmarks contain unique information? Github repos starred for later? Well this is a compilation of all of these resources into a single repo known as Cheatsheet-God No more need for bookmarked links No need to open a w

https://github.com/Striving-to-learn/test

Getting Started in Cybersecurity and Hacking Introduction This guide aims to provide easy-to-access resources for individuals interested in learning more about Cybersecurity and ethical hacking, and bug bounty Below, you will find organized links and resources related to each topic for your convenience Table of Contents Getting Started Hacking and Security Challenges Program

https://github.com/winterwolf32/Cheatsheet-God

+ UPDATE: Added my huge link of bookmarks / references ❤️ Do you have a million bookmarks saved? Do all of those bookmarks contain unique information? Github repos starred for later? Well this is a compilation of all of these resources into a single repo known as Cheatsheet-God No more need for bookmarked links No need to open a w

https://github.com/QWERTSKIHACK/Pentest-BookmarkS

Bookmarks List Hacker Media Blogs There are a LOT of pentesting blogs, these are the ones I monitor constantly and value in the actual day to day testing work Carnal 0wnage - atom McGrew Security GNUCITIZEN Darknet - The Darkside - rss spylogic - rss TaoSecurity - atom Room362 SIPVicious - rss portswigger pentestmonkeyblog jeremiahgrossman i8jesus c22 Skull Security - rss met

https://github.com/themixedcoder/test

Getting Started in Cybersecurity and Hacking Introduction This guide aims to provide easy-to-access resources for individuals interested in learning more about Cybersecurity and ethical hacking, and bug bounty Below, you will find organized links and resources related to each topic for your convenience Table of Contents Getting Started Hacking and Security Challenges Program

https://github.com/hcasaes/Cheatsheet-God

This is a compilation of all of these resources into a single repo known as Cheatsheet-God. No more need for bookmarked links. No need to open a web browser.

+ UPDATE: Added my huge link of bookmarks / references ❤️ Do you have a million bookmarks saved? Do all of those bookmarks contain unique information? Github repos starred for later? Well this is a compilation of all of these resources into a single repo known as Cheatsheet-God No more need for bookmarked links No need to open a w

https://github.com/CyberlearnbyVK/Cheatsheet-God

+ UPDATE: Added my huge link of bookmarks / references ❤️ Do you have a million bookmarks saved? Do all of those bookmarks contain unique information? Github repos starred for later? Well this is a compilation of all of these resources into a single repo known as Cheatsheet-God No more need for bookmarked links No need to open a w

https://github.com/eric-erki/Cheatsheet-God

Penetration Testing Reference Bank - OSCP / PTP & PTX Cheatsheet

+ UPDATE: Added my huge link of bookmarks / references ❤️ Do you have a million bookmarks saved? Do all of those bookmarks contain unique information? Github repos starred for later? Well this is a compilation of all of these resources into a single repo known as Cheatsheet-God No more need for bookmarked links No need to open a w

https://github.com/QWERTSKIHACK/Pentest-Bookmarkz

Bookmarks List Hacker Media Blogs There are a LOT of pentesting blogs, these are the ones I monitor constantly and value in the actual day to day testing work Carnal 0wnage - atom McGrew Security GNUCITIZEN Darknet - The Darkside - rss spylogic - rss TaoSecurity - atom Room362 SIPVicious - rss portswigger pentestmonkeyblog jeremiahgrossman i8jesus c22 Skull Security - rss met

https://github.com/D4rkSi3er/Cyber-Sec-Resources

Cyber-Sec-Resources Getting Started in Cybersecurity and Hacking Introduction Getting Started in Cybersecurity Entering the world of cybersecurity can feel overwhelming with numerous resources available This guide simplifies the journey for newcomers interested in technology, cybersecurity, ethical hacking, and bug bounty hunting Use the Table of Contents as your roadmap Be

https://github.com/SofianeHamlaoui/Pentest-Bookmarkz

A collection of useful links for Pentesters

Bookmarks List Hacker Media Blogs There are a LOT of pentesting blogs, these are the ones I monitor constantly and value in the actual day to day testing work Carnal 0wnage - atom McGrew Security GNUCITIZEN Darknet - The Darkside - rss spylogic - rss TaoSecurity - atom Room362 SIPVicious - rss portswigger pentestmonkeyblog jeremiahgrossman i8jesus c22 Skull Security - rss met

https://github.com/mishmashclone/OlivierLaflamme-Cheatsheet-God

https://github.com/OlivierLaflamme/Cheatsheet-God

+ UPDATE: Added my huge link of bookmarks / references ❤️ Do you have a million bookmarks saved? Do all of those bookmarks contain unique information? Github repos starred for later? Well this is a compilation of all of these resources into a single repo known as Cheatsheet-God No more need for bookmarked links No need to open a w

https://github.com/hvardhanx/pentest-bookmarks

Automatically exported from code.google.com/p/pentest-bookmarks

pentest-bookmarks Automatically exported from codegooglecom/p/pentest-bookmarks #summary Bookmarks List = Hacker Media = == Blogs Worth It: == What the title says There are a LOT of pentesting blogs, these are the ones i monitor constantly and value in the actual day to day testing work * carnal0wnageblogspotcom/ * wwwmcgrewsecuritycom/ * wwwgnucit

Recent Articles

Hackers: 'ColdFusion bug more serious than Adobe says'
The Register • Dan Goodin • 16 Aug 2010

'It works, and it's scary'

A recently patched vulnerability in Adobe's ColdFusion application server may be more serious than previously thought following the public release of exploit code and blog posts claiming it can be used to take full control of systems running the software. In a bulletin published last week, Adobe rated the directory traversal vulnerability “important,” the third-highest classification on its four-tier severity scale. “This directory traversal vulnerability could lead to information disclosu...

Read more...

References

CWE-22http://www.adobe.com/support/security/bulletins/apsb10-18.htmlhttp://securityreason.com/securityalert/8148http://securityreason.com/securityalert/8137http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/https://nvd.nist.govhttps://www.theregister.co.uk/2010/08/16/adobe_coldfusion_vuln/https://www.exploit-db.com/exploits/14641/https://github.com/decal/CFMXDC
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-2907hardcodedinjectCVE-2024-20359CVE-2024-2467CVE-2024-4077CVE-2024-22391cameraCVE-2024-20353
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook