PT-2010-5144 · Ibm · Ibm Omnifind Enterprise Edition

Publicado 2010-11-12 · Atualizado 2018-10-10 · CVE-2010-3890

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM OmniFind Enterprise Edition versions prior to 9.1

Description The issue allows remote attackers to inject arbitrary web script or HTML via the command parameter to the administration interface. This can be demonstrated by the command parameter to "ESAdmin/collection.do" API endpoint.

Recommendations For versions prior to 9.1, update to version 9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the administration interface and the "ESAdmin/collection.do" API endpoint to minimize the risk of exploitation. Avoid using the command parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-3890

Produtos afetados

Ibm Omnifind Enterprise Edition

Referências · 5

• 🔥 http://securityfocus.com/bid/44740 · Exploit
• 🔥 http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt · Exploit
• http://vupen.com/english/advisories/2010/2933 · Aviso do Fabricante
• http://securityfocus.com/archive/1/514688/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3890 · Nota de Segurança