CVE-2010-2278
First published: Tue Jun 15 2010(Updated: )
The bookmarklet pop-up in the Bookmarks component in IBM Lotus Connections 2.5.x before 2.5.0.2 does not properly follow the "force SSL" setting, which might make it easier for remote attackers to obtain the cleartext of network communication by sniffing the network, or spoof arbitrary servers via a man-in-the-middle attack.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Connections | =2.5.0 | |
| IBM Connections | =2.5.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO47669
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO47496
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO47429
- http://www.vupen.com/english/advisories/2010/1281
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO47501
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO47610
- http://secunia.com/advisories/40007
- http://www-01.ibm.com/support/docview.wss?uid=swg21431472
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO47642
Frequently Asked Questions
What is the severity of CVE-2010-2278?
CVE-2010-2278 is classified as a moderate risk vulnerability due to its potential for exposing cleartext data during network communication.
What software versions are affected by CVE-2010-2278?
CVE-2010-2278 affects IBM Lotus Connections versions 2.5.0 and 2.5.0.1.
How do I fix CVE-2010-2278?
To mitigate CVE-2010-2278, you should upgrade to IBM Lotus Connections version 2.5.0.2 or later.
What impact does CVE-2010-2278 have on network security?
CVE-2010-2278 can allow remote attackers to intercept cleartext network communication, increasing the risk of data exposure.
Is there any workaround for CVE-2010-2278?
Currently, there are no specific workarounds available for CVE-2010-2278, making updates the best solution.
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/references
- agent/weakness
- agent/remedy
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/ibm
- canonical/ibm connections
- version/ibm connections/2.5.0
- version/ibm connections/2.5.0.1