Lucene search

[email protected]CVE-2010-3893

HistoryNov 12, 2010 - 10:00 p.m.

CVE-2010-3893

2010-11-1222:00:00

CWE-264

[email protected]

web.nvd.nist.gov

ibm

omnifind

enterprise edition

cve-2010-3893

session impersonation

cookie theft

security vulnerability

6.8 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.008 Low

EPSS

Percentile

81.9%

JSON

The administrator interface in IBM OmniFind Enterprise Edition 8.x and 9.x does not restrict use of a session ID (aka SID) value to a single IP address, which allows remote attackers to perform arbitrary administrative actions by leveraging cookie theft, related to a “session impersonation” issue.

CPENameOperatorVersion
ibm:omnifindibm omnifindeq9.0
ibm:omnifindibm omnifindeq8.0
ibm:omnifindibm omnifindeq8.5
ibm:omnifindibm omnifindeq8.4
ibm:omnifindibm omnifindeq9.1

CPE	Name	Operator	Version
ibm:omnifind	ibm omnifind	eq	9.0
ibm:omnifind	ibm omnifind	eq	8.0
ibm:omnifind	ibm omnifind	eq	8.5
ibm:omnifind	ibm omnifind	eq	8.4
ibm:omnifind	ibm omnifind	eq	9.1

References

security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt

www.securityfocus.com/archive/1/514688/100/0/threaded

www.securityfocus.com/bid/44740

www.vupen.com/english/advisories/2010/2933

6.8 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.008 Low

EPSS

Percentile

81.9%

JSON

Related for CVE-2010-3893

prion1 cvelist1 packetstorm1 securityvulns2