CVE-2010-3898

Published: Nov 12, 2010Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

IBM OmniFind Enterprise Edition 8.x and 9.x does not properly restrict the cookie path of administrator (aka ESAdmin) cookies, which might allow remote attackers to bypass authentication by leveraging access to other pages on the web site.

Affected (5)

Products: Ibm: Omnifind

Ibm

1 product

Omnifind

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Ibm Omnifind	Version 8.0
Ibm Omnifind	Version 8.4
Ibm Omnifind	Version 8.5
Ibm Omnifind	Version 9.0
Ibm Omnifind	Version 9.1

Related CWEs

CWE-264

References (8)

http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/514688/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/44740

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/2933

Source: cve@mitre.org

Vendor Advisory

http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/514688/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/44740

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/2933

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.