« Volver al listado

CVE-2007-5701

Estado: ModificadaBaja (2.1)—

Incomplete blacklist vulnerability in the Certificate Authority (CA) in IBM Lotus Domino before 7.0.3 allows local users, or attackers with physical access, to obtain sensitive information (passwords) when an administrator enters a "ca activate" or "ca unlock" command with any uppercase character, which bypasses a blacklist designed to suppress password logging, resulting in cleartext password disclosure in the console log and Admin panel.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — Lotus Domino

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-5701",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-10-29T21:46:00.000",
  "references": [
    {
      "url": "http://osvdb.org/40952",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/27321",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg21261095",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/26176",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3598",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37372",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/40952",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27321",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg21261095",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/26176",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3598",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37372",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incomplete blacklist vulnerability in the Certificate Authority (CA) in IBM Lotus Domino before 7.0.3 allows local users, or attackers with physical access, to obtain sensitive information (passwords) when an administrator enters a \"ca activate\" or \"ca unlock\" command with any uppercase character, which bypasses a blacklist designed to suppress password logging, resulting in cleartext password disclosure in the console log and Admin panel."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de lista negra incompleta en la  Autoridad de Certificación (CA) de IBM Lotus Domino versiones anteriores a 7.0.3 permite a usuarios locales, o atacantes con acceso físico, obtener información confidencial (contraseñas) cuando un administrador introduce un comando \"ca activate\" ó \"ca unlock\" con cualquier caracter mayúsuclas, lo cual evita una lista negra diseñada para evitar autenticación con contraseña, provocando la visualización de la contraseña en texto en claro por la consola de trazas y el panel de administración."
    }
  ],
  "lastModified": "2026-06-16T22:46:39.760",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:6.5.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C709D66D-3AE7-48B7-9E27-5D1FE452643C"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:6.5.5:*:fp1:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B0B5F96-0762-45D3-B13E-1E4ED04AD69D"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:6.5.5:*:fp2:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB1EA406-6488-46C0-B857-0BFFAA65B258"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:6.5.5:*:fp3:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D36E3D33-5A60-4846-BED2-8BF3AFC9BBE2"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:6.5.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB5AE863-C29F-4D32-8845-2D2426085071"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:6.5.6:*:fp1:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1DD8A9BA-5E05-47D8-9C15-60A49A3C3141"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8FDDB5FD-9152-4A9C-829B-8BA2ACB3A5A1"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:7.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69495B18-39A4-443F-A724-F713C4DD14A2"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:7.0.2:*:fp1:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A7F62D7-8225-4B84-A3CE-B91616B5AAD9"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:7.0.2:*:fp2:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82718D37-02FA-4EA0-ABB6-167B5A0A2F0B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}