PT-2006-1719 · Ibm · Lotus Domino Inotes Client

Publicado

2006-02-13

·

Atualizado

2017-07-20

·

CVE-2006-0663

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Lotus Domino iNotes Client versions 6.5.4 through 7.0
Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various means, including an email subject, an encoded javascript URI (e.g., "java script:"), or an email attachment filename when the Domino Web Access ActiveX control is not installed.
Recommendations For Lotus Domino iNotes Client versions 6.5.4 through 7.0, consider disabling the execution of JavaScript code in email subjects and attachments to minimize the risk of exploitation. Restrict access to email attachments when the Domino Web Access ActiveX control is not installed. Avoid using encoded javascript URIs in emails until the issue is resolved.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2006-0663

Produtos afetados

Lotus Domino Inotes Client