PT-2009-5441 · Microsoft+1 · Internet Explorer+1

Published 2009-09-09 · Updated 2018-10-10 · CVE-2009-3114

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: IBM Lotus Notes versions 8.0 through 8.5

Description: The issue concerns the RSS reader widget, which saves items from an RSS feed as local HTML documents. This allows remote attackers to execute arbitrary script in Internet Explorer's Local Machine Zone via a crafted feed.

Recommendations: For IBM Lotus Notes versions 8.0 through 8.5, consider disabling the RSS reader widget until a patch is available to prevent the execution of arbitrary scripts.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-3114

Affected Products

Ibm Lotus Notes

Internet Explorer

References · 7

• http://www-01.ibm.com/support/docview.wss?uid=swg21403834 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3114 · Security Note
• http://secunia.com/advisories/36813 · Vendor Advisory
• http://securityfocus.com/bid/36305 · Note
• http://scip.ch/?vuldb.4021 · Note
• http://securityfocus.com/archive/1/506296/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3114 · Note