March 25, 2022 · Applied Cybernetics Group
CVE-2010-2861 — Adobe ColdFusion
known ransomware use
Adobe ColdFusion Directory Traversal Vulnerability
- Added to KEV
2022-03-25- Federal due date
2022-04-15- Vendor
- Adobe
- Product
- ColdFusion
- EPSS
- 100.0th percentile (score 0.997, as of
2026-09-16) - NVD CVSS v3.1
- 9.8 (CRITICAL)
- Ransomware use
- Known
- ATT&CK
- T1105 , T1119 , T1190 · signal rollup
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2010-2861
CISA short description
A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.
Required action
Apply updates per vendor instructions.
NVD description
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.