CVE-2010-4591

CVE-2010-4591 describes a vulnerability in IBM Lotus Mobile Connect (LMC) versions prior to 6.1.4, specifically when HTTP Access Services (HTTP-AS) is enabled. The Connection Manager fails to properly delete LTPA tokens upon iNotes logoff, potentially allowing an attacker with physical access to an unattended client to gain unauthorized access due to a cookie domain mismatch. This vulnerability has a CVSS score of 4.4, indicating a medium severity. It requires local access (AV:L) and moderate attack complexity (AC:M) with no authentication needed (Au:N), potentially leading to partial confidentiality, integrity, and availability impacts (C:P/I:P/A:P). There is no evidence of active exploitation for CVE-2010-4591, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Furthermore, there is minimal community discussion or media coverage surrounding this CVE, suggesting it has not garnered significant attention.