CVE-2007-0977: High severity IBM Lotus Domino vulnerability
Published Feb 16, 2007
·Updated
IBM Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores HTTPPassword hashes from names.nsf in a manner accessible through Readviewentries and OpenDocument requests to the defaultview view, a different vector than CVE-2005-2428.
Affected Software
2 affected components
IBM Lotus Domino=5.0
IBM Lotus Domino=6.0
Event History
Feb 16, 2007
CVE Published
01:28 AM
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-0977?
CVE-2007-0977 is considered a high severity vulnerability due to the exposure of HTTPPassword hashes.
2
How do I fix CVE-2007-0977?
To fix CVE-2007-0977, you should disable the "Generate HTML for all fields" option in IBM Lotus Domino.
3
What versions of IBM Lotus Domino are affected by CVE-2007-0977?
CVE-2007-0977 affects IBM Lotus Domino versions 5.0 and 6.0.
4
What type of information is exposed in CVE-2007-0977?
CVE-2007-0977 exposes HTTPPassword hashes stored in a way that can be accessed through specific requests.
5
What actions should be taken to mitigate the risks of CVE-2007-0977?
To mitigate risks associated with CVE-2007-0977, it is recommended to upgrade to a patched version of IBM Lotus Domino.