Description
The ESSearchApplication directory tree in IBM OmniFind Enterprise Edition 8.x and 9.x does not require authentication, which allows remote attackers to modify the server configuration via a request to palette.do.
References
- 20101109 IBM OmniFind - several vulnerabilities mailing-list
- 44740 vdb-entry
- http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt
- ADV-2010-2933 vdb-entry