CVE-2008-7253

2010-01-2519:30:00

CWE-16

[email protected]

web.nvd.nist.gov

ibm

lotus domino

server

web server

http trace

remote attackers

authentication credentials

cve-2008-7253

6.2 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

70.0%

JSON

The default configuration of the web server in IBM Lotus Domino Server, possibly 6.0 through 8.0, enables the HTTP TRACE method, which makes it easier for remote attackers to steal cookies and authentication credentials via a cross-site tracing (XST) attack, a related issue to CVE-2004-2763 and CVE-2005-3398.

CPENameOperatorVersion
ibm:lotus_domino_serveribm lotus domino servereq7.0
ibm:lotus_domino_serveribm lotus domino servereq6.0
ibm:lotus_domino_serveribm lotus domino servereq6.5
ibm:lotus_domino_serveribm lotus domino servereq8.0

CPE	Name	Operator	Version
ibm:lotus_domino_server	ibm lotus domino server	eq	7.0
ibm:lotus_domino_server	ibm lotus domino server	eq	6.0
ibm:lotus_domino_server	ibm lotus domino server	eq	6.5
ibm:lotus_domino_server	ibm lotus domino server	eq	8.0