CVE Daily

CVE-2010-4591

The Connection Manager in IBM Lotus Mobile Connect (LMC) before 6.1.4, when HTTP...

Medium CVSS 4.4

Overview

The Connection Manager in IBM Lotus Mobile Connect (LMC) before 6.1.4, when HTTP Access Services (HTTP-AS) is enabled, does not delete LTPA tokens in response to use of the iNotes Logoff button, which might allow physically proximate attackers to obtain access via an unattended client, related to a cookie domain mismatch.

CWE: CWE-287 Published: 2010-12-22T21:00:19.863
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 4.4 (MEDIUM)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags