CVE-2000-0021: Medium severity Lotus Domino Server vulnerability
Lotus Domino HTTP server allows remote attackers to determine the real path of the server via a request to a non-existent script in /cgi-bin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable execution of CGI scripts in the /cgi-bin directory or configure the HTTP server to avoid revealing filesystem real paths in error responses. If CGI functionality is required, restrict execution to authenticated or trusted hosts.
IBM Lotus Domino HTTP server (cgi-bin) cgi-bin access / CGI script execution = disabled or restricted - Compensating control
Restrict HTTP access to the /cgi-bin path at the network perimeter (firewall, WAF, or reverse proxy) to trusted IP addresses or require authentication to prevent remote path-disclosure attempts.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0021?
The severity of CVE-2000-0021 is considered to be medium, as it can potentially leak sensitive server information.
How do I fix CVE-2000-0021?
To fix CVE-2000-0021, upgrade to a later version of Lotus Domino Server that addresses this vulnerability.
What type of attacks can result from CVE-2000-0021?
CVE-2000-0021 can be exploited by attackers to gain insights into the server's file structure and paths.
Which versions of Lotus Domino Server are affected by CVE-2000-0021?
CVE-2000-0021 specifically affects Lotus Domino Server version 4.6.
How can I mitigate the risks associated with CVE-2000-0021?
Mitigation measures include restricting access to the CGI-bin directory and implementing security policies to monitor abnormal requests.