Vulnerabilities > CVE-2010-3897 - Credentials Management vulnerability in IBM Omnifind

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
low complexity
ibm
CWE-255
NVD
Published: 2010-11-12
Updated: 2018-10-10

Summary

ESSearchApplication/palette.do in IBM OmniFind Enterprise Edition 8.x and 9.x includes the administrator password in the HTML source code, which might allow remote attackers to obtain sensitive information by leveraging read access to this file.

Vulnerable Configurations

Part Description Count
Application
Ibm
5

Common Weakness Enumeration (CWE)

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/95687/ibmomnifind-xssescalate.txt
idPACKETSTORM:95687
last seen2016-12-05
published2010-11-10
reporterFatih Kilic
sourcehttps://packetstormsecurity.com/files/95687/IBM-OmniFind-Cross-Site-Scripting-Privilege-Escalation.html
titleIBM OmniFind Cross Site Scripting / Privilege Escalation

References