Adobe ColdFusion Solr Service Information Disclosure Vulnerability

Bugtraq ID:	38007
Class:	Unknown
CVE:	CVE-2010-0185
Remote:	Yes
Local:	No
Published:	Jan 29 2010 12:00AM
Updated:	Jan 29 2010 12:00AM
Credit:	Antero Ortiz
Vulnerable:	Adobe ColdFusion 9.0
Not Vulnerable:

Adobe ColdFusion Solr Service Information Disclosure Vulnerability

Adobe ColdFusion is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information.

ColdFusion 9.0 is vulnerable; other versions may also be affected.

Adobe ColdFusion Solr Service Information Disclosure Vulnerability

Attackers can use readily available tools to exploit this issue.

Adobe ColdFusion Solr Service Information Disclosure Vulnerability

Solution:
Adobe has published instructions on disabling external access to the Solr collections. Please see the references for details.

Adobe ColdFusion Solr Service Information Disclosure Vulnerability

References:

• Adobe ColdFusion Homepage (Adobe)
  
• ColdFusion 9: How to limit access to the Solr collections (Adobe)
  
• APSB10-04 Solution available for potential ColdFusion information disclosure iss (Adobe)