CVE-2010-4591

The Connection Manager in IBM Lotus Mobile Connect (LMC) before 6.1.4, when HTTP Access Services (HTTP-AS) is enabled, does not delete LTPA tokens in response…

published December 22, 2010

CVSS
—
EPSS
0%
Percentile
18.7
In the wild
Unconfirmed
What it is

The Connection Manager in IBM Lotus Mobile Connect (LMC) before 6.1.4, when HTTP Access Services (HTTP-AS) is enabled, does not delete LTPA tokens in response to use of the iNotes Logoff button, which might allow physically proximate attackers to obtain access via an unattended client, related to a cookie domain mismatch.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00274 · 18.7th percentile
Published
2010-12-22T20:00Z
EPSS history
Timeline
  • 22 DEC 20:00Z
    The Connection Manager in IBM Lotus Mobile Connect (LMC) before 6.1.4, when HTTP Access Services (HTTP-AS) is enabled, does not delete LTPA tokens in response…
    cvelistv5