vulnwire
5.0med

CVE-2005-24282 exploitsNuclei template

Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, wh…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
73.0%
percentile 99%
Public exploits
2
Exploit-DB · Nuclei check

Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as (1) the password hash in the HTTPPassword field, (2) the password change date in the HTTPPasswordChangeDate field, (3) the client platform in the ClntPltfrm field, (4) the client machine name in the ClntMachine field, and (5) the client Lotus Domino release in the ClntBld field, a different vulnerability than CVE-2005-2696.

Exploit prediction (EPSS)

73.03% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

  • Nuclei template Lotus Domino R5 and R6 WebMail - Information Disclosure · nuclei detection template
  • EDB-39495 IBM Lotus Domino R8 - Password Hash Extraction · webapps · 2016-02-25
  • EDB-3302 Lotus Domino R6 Webmail - Remote Password Hash Dumper · remote · 2007-02-13

CVSS scores

Assigned byVersionScoreVector
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

References

  • marc.info /?l=bugtraq&m=112240869130356&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securityfocus.com /bid/14389 · vdb-entry, x_refsource_BID, x_transferred
  • exploit-db.com /exploits/39495/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • www-1.ibm.com /support/docview.wss?uid=swg21212934 · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id?1014584 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • osvdb.org /18462 · vdb-entry, x_refsource_OSVDB, x_transferred
  • cybsec.com /vuln/default_configuration_information_disclosure_lotus_domino.pdf · x_refsource_MISC, x_transferred
  • securiteam.com /securitynews/5FP0E15GLQ.html · x_refsource_MISC, x_transferred
  • secunia.com /advisories/16231/ · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/21556 · vdb-entry, x_refsource_XF, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.