Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2010-3891: IBM OmniFind Enterprise admin login can be hijacked

CVE-2010-3891 · published 15 years ago

Summary

The web‑based admin console in IBM OmniFind Enterprise before version 9.1 can be tricked into performing actions on behalf of an administrator. An attacker could add a new admin user without the real admin’s knowledge, effectively taking over the system. Apply the vendor’s security update or restrict access to the admin interface to trusted users only.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	omnifind	<= 9.0 8.0 8.4 8.5 `cpe:2.3:a:ibm:omnifind::-:enterprise:::::`

Original advisory text

Cross-site request forgery (CSRF) vulnerability in ESAdmin/security.do in the administrator interface in IBM OmniFind Enterprise Edition before 9.1 allows remote attackers to hijack the authentication of administrators for requests that add an administrative user via a saveNewUser action.

References

http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt Exploit
http://www.exploit-db.com/exploits/15473 Exploit
http://www.osvdb.org/69083
http://www.securityfocus.com/archive/1/514688/100/0/threaded
http://www.securityfocus.com/bid/44740 Exploit
http://www.vupen.com/english/advisories/2010/2933 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.8 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-352Cross-Site Request Forgery (CSRF)

Timeline

Published12 Nov 2010

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2010-3891 · NVD

Track software like this

Free during beta