« Back to list

CVE-2007-5701

Status: ModifiedLow (2.1)—

Incomplete blacklist vulnerability in the Certificate Authority (CA) in IBM Lotus Domino before 7.0.3 allows local users, or attackers with physical access, to obtain sensitive information (passwords) when an administrator enters a "ca activate" or "ca unlock" command with any uppercase character, which bypasses a blacklist designed to suppress password logging, resulting in cleartext password disclosure in the console log and Admin panel.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

IBM — Lotus Domino

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2007-5701",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-10-29T21:46:00.000",
  "references": [
    {
      "url": "http://osvdb.org/40952",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/27321",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg21261095",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/26176",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3598",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37372",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/40952",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27321",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg21261095",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/26176",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3598",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37372",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incomplete blacklist vulnerability in the Certificate Authority (CA) in IBM Lotus Domino before 7.0.3 allows local users, or attackers with physical access, to obtain sensitive information (passwords) when an administrator enters a \"ca activate\" or \"ca unlock\" command with any uppercase character, which bypasses a blacklist designed to suppress password logging, resulting in cleartext password disclosure in the console log and Admin panel."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de lista negra incompleta en la  Autoridad de Certificación (CA) de IBM Lotus Domino versiones anteriores a 7.0.3 permite a usuarios locales, o atacantes con acceso físico, obtener información confidencial (contraseñas) cuando un administrador introduce un comando \"ca activate\" ó \"ca unlock\" con cualquier caracter mayúsuclas, lo cual evita una lista negra diseñada para evitar autenticación con contraseña, provocando la visualización de la contraseña en texto en claro por la consola de trazas y el panel de administración."
    }
  ],
  "lastModified": "2026-06-16T22:46:39.760",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:6.5.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C709D66D-3AE7-48B7-9E27-5D1FE452643C"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:6.5.5:*:fp1:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B0B5F96-0762-45D3-B13E-1E4ED04AD69D"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:6.5.5:*:fp2:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB1EA406-6488-46C0-B857-0BFFAA65B258"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:6.5.5:*:fp3:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D36E3D33-5A60-4846-BED2-8BF3AFC9BBE2"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:6.5.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB5AE863-C29F-4D32-8845-2D2426085071"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:6.5.6:*:fp1:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1DD8A9BA-5E05-47D8-9C15-60A49A3C3141"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8FDDB5FD-9152-4A9C-829B-8BA2ACB3A5A1"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:7.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69495B18-39A4-443F-A724-F713C4DD14A2"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:7.0.2:*:fp1:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A7F62D7-8225-4B84-A3CE-B91616B5AAD9"
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:7.0.2:*:fp2:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82718D37-02FA-4EA0-ABB6-167B5A0A2F0B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}