CVE-2010-4591

Published: Dec 22, 2010Modified: Apr 29, 2026

4.4

Vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 3.4 / Impact: 6.4

Source: NVD

Description

The Connection Manager in IBM Lotus Mobile Connect (LMC) before 6.1.4, when HTTP Access Services (HTTP-AS) is enabled, does not delete LTPA tokens in response to use of the iNotes Logoff button, which might allow physically proximate attackers to obtain access via an unattended client, related to a cookie domain mismatch.

Affected (4)

Products: Ibm: Lotus Mobile Connect

1 product

Lotus Mobile Connect

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Ibm Lotus Mobile Connect	Up to 6.1.3
Ibm Lotus Mobile Connect	Version 6.1.1.1
Ibm Lotus Mobile Connect	Version 6.1.1
Ibm Lotus Mobile Connect	Version 6.1.2

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (6)

http://secunia.com/advisories/42703

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg1IZ74393

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg27020327

Source: cve@mitre.org

http://secunia.com/advisories/42703

Source: af854a3a-2127-422b-91ae-364da2661108

http://www-01.ibm.com/support/docview.wss?uid=swg1IZ74393

Source: af854a3a-2127-422b-91ae-364da2661108

http://www-01.ibm.com/support/docview.wss?uid=swg27020327

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.