CVE-2011-1520: High severity ibm lotus domino mail server vulnerability
The default configuration of the server console in IBM Lotus Domino does not require a password (aka ServerConsolePassword), which allows physically proximate attackers to perform administrative changes or obtain sensitive information via a (1) Load, (2) Tell, or (3) Set Configuration command.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1520?
CVE-2011-1520 is considered a high severity vulnerability due to the potential for unauthorized administrative access without a password.
How do I fix CVE-2011-1520?
To fix CVE-2011-1520, configure a strong password for the Server_Console_Password in the IBM Lotus Domino settings.
Who is affected by CVE-2011-1520?
Organizations using IBM Lotus Domino with the default settings are affected by CVE-2011-1520.
What types of attacks can exploit CVE-2011-1520?
Attackers can exploit CVE-2011-1520 by executing administrative commands like Load, Tell, or Set Configuration without any authentication.
Is there a patch available for CVE-2011-1520?
Yes, IBM has recommended changes in configuration as the mitigation method for CVE-2011-1520, rather than a specific patch.