CVE-2010-5290: Critical severity adobe coldfusion vulnerability
The authentication process in Adobe ColdFusion before 10 does not require knowledge of the cleartext password if the password hash is known, which makes it easier for context-dependent attackers to obtain administrative privileges by leveraging read access to the configuration file, a different vulnerability than CVE-2010-2861.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability CVE-2010-5290 about?
CVE-2010-5290 allows attackers to obtain administrative privileges in Adobe ColdFusion by leveraging knowledge of the password hash without needing the cleartext password.
What versions of Adobe ColdFusion are affected by CVE-2010-5290?
CVE-2010-5290 affects Adobe ColdFusion versions prior to 10, including 9.0, 9.0.1, and up to 9.0.2.
What are the potential impacts of CVE-2010-5290?
Exploitation of CVE-2010-5290 could lead to unauthorized administrative access to the affected ColdFusion server.
How can I mitigate CVE-2010-5290 vulnerabilities in my Adobe ColdFusion installation?
To mitigate CVE-2010-5290, upgrade Adobe ColdFusion to version 10 or later to eliminate the password hash vulnerability.
Is there a workaround for CVE-2010-5290 if I cannot upgrade Adobe ColdFusion immediately?
A temporary workaround for CVE-2010-5290 is to restrict access to the configuration files to ensure that unauthorized users cannot read the password hash.