PT-2010-5562 · Ibm · Ibm Lotus Mobile Connect

Published 2010-12-22 · Updated 2010-12-27 · CVE-2010-4595

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Lotus Mobile Connect versions prior to 6.1.4

Description The issue concerns the Connection Manager in IBM Lotus Mobile Connect, which fails to properly enforce access restrictions for HTTP Access Services. This allows remote attackers to bypass intended restrictions by sending an HTTP request with a disallowed User-Agent header.

Recommendations For versions prior to 6.1.4, update to version 6.1.4 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-4595

Affected Products

Ibm Lotus Mobile Connect

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2010-4595 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1IZ86207 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg27020327 · Note