CVE-2010-3280 Information disclosure in n/a
Remote attackers can obtain SuperUser credentials via client-side authorization flaws, enabling unauthorized monitoring or reconfiguration of Contact Center operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2010-3280?
CVE-2010-3280 is a medium-severity vulnerability in n/a, published on 23 Sep 2010. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The CCAgent option 9.0.8.4 and earlier in the management server (aka TSA) component in Alcatel-Lucent OmniTouch Contact Center Standard Edition relies on client-side authorization checking, and unconditionally sends the SuperUser password to the client for use during an authorized session, which allows remote attackers to monitor or reconfigure Contact Center operations via a modified client application.
Weakness: CWE-200
Which versions are affected by CVE-2010-3280?
It affects 2 products.
Products include Alcatel-Lucent Ccagent, Alcatel-Lucent Omnitouch Contact Center.
How do I fix CVE-2010-3280?
No fix has been published for CVE-2010-3280 yet. Limit exposure of the affected software until one is available.
Is CVE-2010-3280 being exploited?
There is no known exploitation of CVE-2010-3280 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-8r4h-25v6-93q9.