CVE-2010-2280

Open redirect vulnerability in the Mobile component in IBM Lotus Connections 2.5.x before 2.5.0.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, related to "mobile edit actions," aka SPR ASRE83PPVH.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/40007	Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21431472	Patch Vendor Advisory
http://www.vupen.com/english/advisories/2010/1281	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:lotus_connections:2.5.0:::::::*
	cpe:2.3:a:ibm:lotus_connections:2.5.0.1:::::::*

History

No history.

Information

Published : 2010-06-15 14:30

Updated : 2010-06-17 04:00

NVD link : CVE-2010-2280

Mitre link : CVE-2010-2280

CVE.ORG link : CVE-2010-2280

JSON object : View

Products Affected

ibm

lotus_connections

CWE

NVD-CWE-Other

{"id": "CVE-2010-2280", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2010-06-15T14:30:01.703", "references": [{"url": "http://secunia.com/advisories/40007", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21431472", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2010/1281", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Open redirect vulnerability in the Mobile component in IBM Lotus Connections 2.5.x before 2.5.0.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, related to \"mobile edit actions,\" aka SPR ASRE83PPVH."}, {"lang": "es", "value": "Una vulnerabilidad de redirecci\u00f3n abierta en el componente Mobile de IBM Lotus Connections v2.5.x antes de v2.5.0.2 permite a atacantes remotos redirigir a los usuarios a sitios web de su elecci\u00f3n y llevar a cabo ataques de phishing a trav\u00e9s de vectores no especificados, relacionados con \"acciones de edici\u00f3n m\u00f3vil\". Esta vulnerabilidad tiene en IBM, el c\u00f3digo interno SPR ASRE83PPVH."}], "lastModified": "2010-06-17T04:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:lotus_connections:2.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C158C61A-ADC7-410D-93D1-25F594B089B0"}, {"criteria": "cpe:2.3:a:ibm:lotus_connections:2.5.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F331AFF-4A81-4131-A310-E71B51157EC0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}