Required CVE Record Information
Description
The administrator interface in IBM OmniFind Enterprise Edition 8.x and 9.x does not restrict use of a session ID (aka SID) value to a single IP address, which allows remote attackers to perform arbitrary administrative actions by leveraging cookie theft, related to a "session impersonation" issue.
References 4 Total
Updated:
This container includes required additional information provided by the CVE Program for this vulnerability.
References 4 Total
- securityfocus.com: 20101109 IBM OmniFind - several vulnerabilities mailing-listx_transferred
- securityfocus.com: 44740 vdb-entryx_transferred
- http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt x_transferred
- vupen.com: ADV-2010-2933 vdb-entryx_transferred