CVE-2010-3890

Name of the Vulnerable Software and Affected Versions IBM OmniFind Enterprise Edition versions prior to 9.1

Description The issue allows remote attackers to inject arbitrary web script or HTML via the command parameter to the administration interface. This can be demonstrated by the command parameter to "ESAdmin/collection.do" API endpoint.

Recommendations For versions prior to 9.1, update to version 9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the administration interface and the "ESAdmin/collection.do" API endpoint to minimize the risk of exploitation. Avoid using the command parameter in the affected API endpoint until the issue is resolved.