PT-2013-1384 · Adobe · Coldfusion

Richard Brain · Published 2013-09-20 · Updated 2017-08-29 · CVE-2010-5290

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions prior to 10

Description The authentication process in Adobe ColdFusion does not require knowledge of the cleartext password if the password hash is known. This makes it easier for attackers to obtain administrative privileges by leveraging read access to the configuration file.

Recommendations For versions prior to 10, update to version 10 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2010-5290

Affected Products

Coldfusion

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2010-5290 · Security Note
• http://qualys.immunityinc.com/home/exploitpack/CANVAS/CF_directory_traversal · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/87740 · Note
• http://osvdb.org/97553 · Note
• http://gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5290 · Note