Loading vulnerability…
CVE-2010-2861 is a directory traversal vulnerability in the Adobe ColdFusion administrator console affecting ColdFusion 9.0.1 and earlier. The flaw is exposed through the locale parameter in multiple administrator-facing ColdFusion endpoints, including pages under CFIDE/administrator. By supplying crafted input to that parameter, a remote attacker can traverse directories and read arbitrary files from the underlying web server that should not be publicly accessible. In observed exploitation, attackers used the vulnerability to retrieve sensitive ColdFusion files from an internet-facing server as part of initial access and follow-on compromise activity.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a Python 3 port of a classic exploit for CVE-2010-2861, a directory traversal vulnerability in Adobe ColdFusion. The main file, 14641-v2.py, is a standalone exploit script that connects to a specified host and port, and attempts to read arbitrary files from the server by sending crafted POST requests to several known ColdFusion administrative endpoints under /CFIDE/. The exploit leverages a directory traversal payload in the 'locale' POST parameter to access files such as password.properties. The script prints out the <title> of the returned page or the HTTP headers if no title is found, providing feedback on the success of the attack. The repository is simple, containing only the exploit script and a brief README. No detection or fake code is present; this is a functional proof-of-concept exploit for educational purposes.
This repository contains a single Metasploit auxiliary scanner module targeting a directory traversal vulnerability (CVE-2010-2861) in Adobe ColdFusion (versions MX6, MX7, MX8). The module attempts to exploit the 'locale' parameter in several ColdFusion administrative endpoints (e.g., /CFIDE/administrator/enter.cfm) to traverse directories and retrieve sensitive files such as password.properties, which may contain administrative credentials. The module first fingerprints the target to determine the ColdFusion version and operating system, then constructs the appropriate traversal payload to retrieve the file. The exploit is operational and can be used to confirm the presence of the vulnerability and extract sensitive files from unpatched ColdFusion servers. The code is written in Ruby and is designed to be run within the Metasploit Framework.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A directory traversal vulnerability in Adobe ColdFusion that allows remote attackers to retrieve files from restricted web server directories.
An Adobe ColdFusion vulnerability that the content says was abused by operators behind Cring ransomware for initial access.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.