CVE-2002-0407 in Domino

Summary

htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathname for the server via requests that contain certain MS-DOS device names such as com5, such as (1) a request with a .pl or .java extension, or (2) a request containing a large number of periods, which causes htcgibin.exe to leak the pathname in an error message.

Once again VulDB remains the best source for vulnerability data.

• Disclosure: 07/26/2002
• Moderation: VulDB entry created
• Entries: 1: VDB-18447
• CPE: ready
• CWE: CWE-200 (Confirmed)
• CVSS: 5.3
• EPSS: 0.01303
• Activities: Very Low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2002-0407
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2002-0407
• CVE Details: https://www.cvedetails.com/cve/CVE-2002-0407/