Vulnerability CVE-2010-2278
Published: 2010-06-15   Modified: 2012-02-13

Description:
The bookmarklet pop-up in the Bookmarks component in IBM Lotus Connections 2.5.x before 2.5.0.2 does not properly follow the "force SSL" setting, which might make it easier for remote attackers to obtain the cleartext of network communication by sniffing the network, or spoof arbitrary servers via a man-in-the-middle attack.

Type:

CWE-DesignError

CVSS2 => (AV:N/AC:H/Au:N/C:P/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4/10
4.9/10
4.9/10
Exploit range
Attack complexity
Authentication
Remote
High
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
None
Affected software
IBM -> Lotus connections 

 References:
http://www-01.ibm.com/support/docview.wss?uid=swg21431472
http://www.vupen.com/english/advisories/2010/1281
http://www-1.ibm.com/support/docview.wss?uid=swg1LO47669
http://www-1.ibm.com/support/docview.wss?uid=swg1LO47642
http://www-1.ibm.com/support/docview.wss?uid=swg1LO47610
http://www-1.ibm.com/support/docview.wss?uid=swg1LO47501
http://www-1.ibm.com/support/docview.wss?uid=swg1LO47496
http://www-1.ibm.com/support/docview.wss?uid=swg1LO47429
http://secunia.com/advisories/40007
Copyright 2024, cxsecurity.com

 

Back to Top