PT-2010-5152 · Ibm · Ibm Omnifind Enterprise Edition

Publicado 2010-11-12 · Atualizado 2018-10-10 · CVE-2010-3898

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM OmniFind Enterprise Edition versions 8.x through 9.x

Description The issue is related to the improper restriction of the cookie path of administrator cookies, which could allow remote attackers to bypass authentication by accessing other pages on the website.

Recommendations For IBM OmniFind Enterprise Edition versions 8.x through 9.x, consider restricting access to administrator pages to minimize the risk of exploitation. As a temporary workaround, review and adjust the cookie path settings to properly restrict access to sensitive areas of the web site. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-3898

Produtos afetados

Ibm Omnifind Enterprise Edition

Referências · 5

• http://vupen.com/english/advisories/2010/2933 · Aviso do Fabricante
• http://securityfocus.com/archive/1/514688/100/0/threaded · Nota
• http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3898 · Nota de Segurança
• http://securityfocus.com/bid/44740 · Nota