PT-2002-1135 · Ibm · Lotus Domino Server

Publicado 2002-04-12 · Atualizado 2008-09-05 · CVE-2002-0037

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Lotus Domino Servers versions 4.5x through 5.x

Description The issue allows attackers to bypass the intended Reader and Author access list for a document's object. This is achieved via a Notes API call, specifically the NSFDbReadObject function, which directly accesses the object, thus circumventing access controls.

Recommendations For Lotus Domino Servers versions 4.5x through 5.x, consider restricting access to the NSFDbReadObject function until a patch is available. Additionally, review and enforce the intended Reader and Author access lists for all documents to minimize potential exploitation.

Correção

Identificadores relacionados

CVE-2002-0037

Produtos afetados

Lotus Domino Server

Referências · 5

• http://iss.net/security_center/static/10095.php · Nota
• http://kb.cert.org/vuls/id/657899 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2001-09/0147.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0037 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2001-09/0150.html · Nota