PT-2010-1999 · Adobe · Coldfusion

Published 2010-02-03 · Updated 2017-08-17 · CVE-2010-0185

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion version 9.0

Description The default configuration of Adobe ColdFusion does not restrict access to collections created by the Solr Service, allowing remote attackers to obtain collection metadata, search information, and index data via a request to an unspecified URL.

Recommendations For Adobe ColdFusion version 9.0, restrict access to collections created by the Solr Service to prevent unauthorized access to sensitive data.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-0185

Affected Products

Coldfusion

References · 10

• http://vupen.com/english/advisories/2010/0259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0185 · Security Note
• http://secunia.com/advisories/38387 · Vendor Advisory
• http://adobe.com/support/security/bulletins/apsb10-04.html · Vendor Advisory
• http://securitytracker.com/id?1023519 · Note
• http://kb2.adobe.com/cps/807/cpsid_80719.html · Note
• http://securityfocus.com/bid/38007 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0185 · Note
• http://osvdb.org/62037 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55997 · Note