PT-2010-5144 · Ibm · Ibm Omnifind Enterprise Edition

Published 2010-11-12 · Updated 2018-10-10 · CVE-2010-3890

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM OmniFind Enterprise Edition versions prior to 9.1

Description The issue allows remote attackers to inject arbitrary web script or HTML via the command parameter to the administration interface. This can be demonstrated by the command parameter to "ESAdmin/collection.do" API endpoint.

Recommendations For versions prior to 9.1, update to version 9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the administration interface and the "ESAdmin/collection.do" API endpoint to minimize the risk of exploitation. Avoid using the command parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-3890

Affected Products

Ibm Omnifind Enterprise Edition

References · 5

• 🔥 http://securityfocus.com/bid/44740 · Exploit
• 🔥 http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt · Exploit
• http://vupen.com/english/advisories/2010/2933 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3890 · Security Note
• http://securityfocus.com/archive/1/514688/100/0/threaded · Note