IBM Lotus Notes up to 8.5.3 Web Application information disclosure
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
3.8 | $0-$5k | 0.00 |
A vulnerability classified as problematic has been found in IBM Lotus Notes up to 8.5.3 (Groupware Software). This affects some unknown functionality of the component Web Application. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:
IBM Lotus Notes 8.5.x before 8.5.3 FP3 does not include the HTTPOnly flag in a Set-Cookie header for a web-application cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, aka SPRs JMAS7TRNLN and SRAO8U3Q68.
The weakness was released 12/12/2012 as confirmed bulletin (Website). It is possible to read the advisory at www-01.ibm.com. This vulnerability is uniquely identified as CVE-2012-4846 since 09/06/2012. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.
The vulnerability scanner Nessus provides a plugin with the ID 63281 (IBM Lotus Notes 8.5.1 / 8.5.2 / 8.5.3 < 8.5.3 FP3 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Windows.
Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.
The vulnerability is also documented in the databases at X-Force (79535) and Tenable (63281). Entries connected to this vulnerability are available at 6941, 6942, 6943 and 6944.
Product
Type
Vendor
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.3VulDB Meta Temp Score: 3.8
VulDB Base Score: 4.3
VulDB Temp Score: 3.8
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Information disclosureCWE: CWE-200 / CWE-284 / CWE-266
ATT&CK: T1592
Local: No
Remote: Yes
Availability: 🔍
Status: Unproven
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Nessus ID: 63281
Nessus Name: IBM Lotus Notes 8.5.1 / 8.5.2 / 8.5.3 < 8.5.3 FP3 Multiple Vulnerabilities
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
OpenVAS ID: 803216
OpenVAS Name: IBM Lotus Notes Web Application XSS Vulnerability (Linux)
OpenVAS File: 🔍
OpenVAS Family: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Timeline
09/06/2012 🔍12/12/2012 🔍
12/12/2012 🔍
12/12/2012 🔍
12/12/2012 🔍
12/14/2012 🔍
12/15/2012 🔍
12/19/2012 🔍
12/21/2012 🔍
12/26/2012 🔍
04/20/2021 🔍
Sources
Vendor: ibm.comAdvisory: www-01.ibm.com
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2012-4846 (🔍)
X-Force: 79535 - IBM Lotus Notes HttpOnly flag cookie information disclosure, Medium Risk
SecurityTracker: 1027887 - IBM Lotus Notes Input Validation Flaw Permits Cross-Site Scripting Attacks
Vulnerability Center: 37827 - IBM Lotus Notes HTTPOnly Flag Not Included Allows Remote Information Disclosure via Script Access, Medium
SecurityFocus: 56944 - IBM Lotus Notes CVE-2012-4846 Unspecified Cross Site Scripting Vulnerability
Secunia: 51593 - IBM Lotus Notes Web Application Cross-Site Scripting Vulnerability, Less Critical
OSVDB: 88429
See also: 🔍
Entry
Created: 12/21/2012 10:47Updated: 04/20/2021 12:32
Changes: 12/21/2012 10:47 (85), 04/23/2017 13:46 (1), 04/20/2021 12:32 (3)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.