IBM Lotus Domino Web Access Email Message HTML Injection Vulnerability
BID:23173
Info
IBM Lotus Domino Web Access Email Message HTML Injection Vulnerability
| Bugtraq ID: | 23173 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 28 2007 12:00AM |
| Updated: | Mar 28 2007 07:53PM |
| Credit: | An anonymous researcher working with iDefense is credited with the discovery of this vulnerability. |
| Vulnerable: |
IBM Lotus Domino 7.0.2 IBM Lotus Domino 7.0.1 IBM Lotus Domino 7.0 IBM Lotus Domino 6.5.5 FP2 IBM Lotus Domino 6.5.5 FP1 IBM Lotus Domino 6.5.5 IBM Lotus Domino 6.5.4 FP 2 IBM Lotus Domino 6.5.4 FP 1 IBM Lotus Domino 6.5.4 IBM Lotus Domino 6.5.3 IBM Lotus Domino 6.5.2 IBM Lotus Domino 6.5.1 IBM Lotus Domino 6.5 .0 |
| Not Vulnerable: |
IBM Lotus Domino 7.0.2 FP1 IBM Lotus Domino 6.5.6 |
Discussion
IBM Lotus Domino Web Access Email Message HTML Injection Vulnerability
IBM Lotus Domino Web Access is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker could exploit this vulnerability to execute arbitrary script code in the browser of an unsuspecting victim in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
IBM Lotus Domino Web Access is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker could exploit this vulnerability to execute arbitrary script code in the browser of an unsuspecting victim in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Exploit / POC
IBM Lotus Domino Web Access Email Message HTML Injection Vulnerability
An attacker can exploit this issue by sending a specially crafted email message to an unsuspecting victim.
An attacker can exploit this issue by sending a specially crafted email message to an unsuspecting victim.
Solution / Fix
IBM Lotus Domino Web Access Email Message HTML Injection Vulnerability
Solution:
The vendor has released updates to address this issue. Please see the referenced advisory for details on obtaining and applying the appropriate updates.
Solution:
The vendor has released updates to address this issue. Please see the referenced advisory for details on obtaining and applying the appropriate updates.
References
IBM Lotus Domino Web Access Email Message HTML Injection Vulnerability
References:
References: