CVE-2002-2191: Medium severity Lotus Domino vulnerability

Published Dec 31, 2002

Updated

Lotus Domino 5.0.9a and earlier, even when configured with the 'DominoNoBanner=1' option, allows remote attackers to obtain potential sensitive information such as the version via a request for a non-existent .nsf database, which leaks the version in the HTTP banner.

Affected Software

3 affected components

Lotus Domino=5.0.9

Lotus Domino=5.0.9a

Lotus Domino=5.0.8

Remediation

Patch Available

http://www.securityfocus.com/archive/1/298874/2002-11-05/2002-11-11/2

Event History

Dec 31, 2002

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

RemedyDescriptionSeverityAffected Software

Nov 16, 2005

CVE Published

via MITRE·09:17 PM

Data Sourced

via MITRE·09:17 PM

Description

Frequently Asked Questions

What is the severity of CVE-2002-2191?

CVE-2002-2191 is classified as a medium-severity vulnerability due to its information disclosure nature.

How do I fix CVE-2002-2191?

To mitigate CVE-2002-2191, ensure that Lotus Domino is upgraded to a version later than 5.0.9a.

What type of information can be leaked by CVE-2002-2191?

CVE-2002-2191 can leak sensitive information such as the software version running on the server.

Which versions of Lotus Domino are affected by CVE-2002-2191?

CVE-2002-2191 affects Lotus Domino versions 5.0.8, 5.0.9, and 5.0.9a.

How does CVE-2002-2191 exploit the system?

CVE-2002-2191 exploits the system by allowing remote attackers to request a non-existent .nsf database, which triggers an HTTP banner leak.