PT-2013-1384 · Adobe · Coldfusion

Richard Brain · Publicado 2013-09-20 · Atualizado 2017-08-29 · CVE-2010-5290

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions prior to 10

Description The authentication process in Adobe ColdFusion does not require knowledge of the cleartext password if the password hash is known. This makes it easier for attackers to obtain administrative privileges by leveraging read access to the configuration file.

Recommendations For versions prior to 10, update to version 10 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2010-5290

Produtos afetados

Coldfusion

Referências · 6

• http://qualys.immunityinc.com/home/exploitpack/CANVAS/CF_directory_traversal · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/87740 · Nota
• http://osvdb.org/97553 · Nota
• http://gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5290 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-5290 · Nota de Segurança