PT-2011-3186 · Ibm · Ibm Lotus Domino

Patrik Karlsson · Published 2011-03-25 · Updated 2018-10-09 · CVE-2011-1520

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Lotus Domino (affected versions not specified)

Description The default configuration of the server console in IBM Lotus Domino does not require a password, allowing physically proximate attackers to perform administrative changes or obtain sensitive information via a Load, Tell, or Set Configuration command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2011-1520

Affected Products

Ibm Lotus Domino

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2011-1520 · Security Note
• http://securityreason.com/securityalert/8164 · Note
• http://lotus.com/ldd/dominowiki.nsf/dx/server_console_password · Note
• http://publib.boulder.ibm.com/infocenter/domhelp/v8r0/index.jsp?topic=/com.ibm.help.domino.admin.doc/DOC/H_THE_DOMINO_CONTROLLER_AND_CONSOLE_OVER.html · Note
• http://zerodayinitiative.com/advisories/ZDI-11-110 · Note
• http://lotus.com/ldd/doc/domino_notes/rnext/help6_admin.nsf/2e73cbb2141acefa85256b8700688cea/0c50e423038555d085256c1d003a31f0?OpenDocument · Note
• http://securityfocus.com/archive/1/517119/100/0/threaded · Note