What is the vulnerability CVE-2010-5290 about?

CVE-2010-5290 allows attackers to obtain administrative privileges in Adobe ColdFusion by leveraging knowledge of the password hash without needing the cleartext password.

What versions of Adobe ColdFusion are affected by CVE-2010-5290?

CVE-2010-5290 affects Adobe ColdFusion versions prior to 10, including 9.0, 9.0.1, and up to 9.0.2.

What are the potential impacts of CVE-2010-5290?

Exploitation of CVE-2010-5290 could lead to unauthorized administrative access to the affected ColdFusion server.

How can I mitigate CVE-2010-5290 vulnerabilities in my Adobe ColdFusion installation?

To mitigate CVE-2010-5290, upgrade Adobe ColdFusion to version 10 or later to eliminate the password hash vulnerability.

Is there a workaround for CVE-2010-5290 if I cannot upgrade Adobe ColdFusion immediately?

A temporary workaround for CVE-2010-5290 is to restrict access to the configuration files to ensure that unauthorized users cannot read the password hash.

Vulnerability/
CVE-2010-5290

critical

CWE

255

20/9/2013

7/8/2024

CVE-2010-5290

First published: Fri Sep 20 2013(Updated: )

The authentication process in Adobe ColdFusion before 10 does not require knowledge of the cleartext password if the password hash is known, which makes it easier for context-dependent attackers to obtain administrative privileges by leveraging read access to the configuration file, a different vulnerability than CVE-2010-2861.

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
Adobe ColdFusion	=9.0
Adobe ColdFusion	<=9.0.2
Adobe ColdFusion	=9.0.1

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the vulnerability CVE-2010-5290 about?
CVE-2010-5290 allows attackers to obtain administrative privileges in Adobe ColdFusion by leveraging knowledge of the password hash without needing the cleartext password.
What versions of Adobe ColdFusion are affected by CVE-2010-5290?
CVE-2010-5290 affects Adobe ColdFusion versions prior to 10, including 9.0, 9.0.1, and up to 9.0.2.
What are the potential impacts of CVE-2010-5290?
Exploitation of CVE-2010-5290 could lead to unauthorized administrative access to the affected ColdFusion server.
How can I mitigate CVE-2010-5290 vulnerabilities in my Adobe ColdFusion installation?
To mitigate CVE-2010-5290, upgrade Adobe ColdFusion to version 10 or later to eliminate the password hash vulnerability.
Is there a workaround for CVE-2010-5290 if I cannot upgrade Adobe ColdFusion immediately?
A temporary workaround for CVE-2010-5290 is to restrict access to the configuration files to ensure that unauthorized users cannot read the password hash.

agent/references
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/author
agent/last-modified-date
agent/weakness
agent/severity
agent/description
agent/first-publish-date
agent/event
agent/source
agent/tags
collector/nvd-historical
agent/software-canonical-lookup-request
collector/nvd-index
vendor/adobe
canonical/adobe coldfusion
version/adobe coldfusion/9.0
version/adobe coldfusion/9.0.2
version/adobe coldfusion/9.0.1

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.