PT-2010-5152 · Ibm · Ibm Omnifind Enterprise Edition

Published 2010-11-12 · Updated 2018-10-10 · CVE-2010-3898

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM OmniFind Enterprise Edition versions 8.x through 9.x

Description The issue is related to the improper restriction of the cookie path of administrator cookies, which could allow remote attackers to bypass authentication by accessing other pages on the website.

Recommendations For IBM OmniFind Enterprise Edition versions 8.x through 9.x, consider restricting access to administrator pages to minimize the risk of exploitation. As a temporary workaround, review and adjust the cookie path settings to properly restrict access to sensitive areas of the web site. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-3898

Affected Products

Ibm Omnifind Enterprise Edition

References · 5

• http://vupen.com/english/advisories/2010/2933 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3898 · Security Note
• http://securityfocus.com/archive/1/514688/100/0/threaded · Note
• http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt · Note
• http://securityfocus.com/bid/44740 · Note