CVE-2010-0185

The default configuration of Adobe ColdFusion 9.0 does not restrict access to collections that have been created by the Solr Service, which allows remote attackers to obtain collection metadata, search information, and index data via a request to an unspecified URL.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securitytracker.com/id?1023519
http://osvdb.org/62037
http://kb2.adobe.com/cps/807/cpsid_80719.html
http://www.securityfocus.com/bid/38007
http://www.adobe.com/support/security/bulletins/apsb10-04.html	Vendor Advisory
http://www.vupen.com/english/advisories/2010/0259	Vendor Advisory
http://secunia.com/advisories/38387	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/55997

Configurations

Configuration 1 (hide)

cpe:2.3:a:adobe:coldfusion:9.0:*:*:*:*:*:*:*

Information

Published : 2010-02-03 10:30

Updated : 2017-08-16 18:31

NVD link : CVE-2010-0185

Mitre link : CVE-2010-0185

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Products Affected

adobe

coldfusion

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securitytracker.com/id?1023519", "name": "1023519", "tags": [], "refsource": "SECTRACK"}, {"url": "http://osvdb.org/62037", "name": "62037", "tags": [], "refsource": "OSVDB"}, {"url": "http://kb2.adobe.com/cps/807/cpsid_80719.html", "name": "http://kb2.adobe.com/cps/807/cpsid_80719.html", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/38007", "name": "38007", "tags": [], "refsource": "BID"}, {"url": "http://www.adobe.com/support/security/bulletins/apsb10-04.html", "name": "http://www.adobe.com/support/security/bulletins/apsb10-04.html", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.vupen.com/english/advisories/2010/0259", "name": "ADV-2010-0259", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "http://secunia.com/advisories/38387", "name": "38387", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55997", "name": "coldfusion-solr-information-disclosure(55997)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The default configuration of Adobe ColdFusion 9.0 does not restrict access to collections that have been created by the Solr Service, which allows remote attackers to obtain collection metadata, search information, and index data via a request to an unspecified URL."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2010-0185", "ASSIGNER": "psirt@adobe.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2010-02-03T18:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:adobe:coldfusion:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-08-17T01:31Z"}

5.0 /10