CVE-2010-3898

IBM OmniFind Enterprise Edition 8.x and 9.x - Authentication Bypass via Cookie Path Manipulation

Title source: llm
STIX 2.1

Description

IBM OmniFind Enterprise Edition 8.x and 9.x does not properly restrict the cookie path of administrator (aka ESAdmin) cookies, which might allow remote attackers to bypass authentication by leveraging access to other pages on the web site.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/514688/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/44740
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/2933

Scores

EPSS 0.0135
EPSS Percentile 68.6%

Details

CWE
CWE-264
Status published
Products (5)
ibm/omnifind 8.0
ibm/omnifind 8.4
ibm/omnifind 8.5
ibm/omnifind 9.0
ibm/omnifind 9.1
Published Nov 12, 2010
Tracked Since Feb 18, 2026