Lucene search

IbmCVE-2016-0304

HistoryJun 29, 2016 - 1:59 a.m.

CVE-2016-0304

2016-06-2901:59:06

CWE-284

ibm

web.nvd.nist.gov

ibm domino

java console

cve-2016-0304

authentication bypass

arbitrary code execution

spr klyha7mm3j

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.018

Percentile

88.4%

JSON

The Java Console in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6, when a certain unsupported configuration involving UNC share pathnames is used, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, aka SPR KLYHA7MM3J. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-0920.

Affected configurations

Nvd

Node

ibmdominoMatch8.5.3

ibmdominoMatch8.5.3.1

ibmdominoMatch8.5.3.2

ibmdominoMatch8.5.3.3

ibmdominoMatch8.5.3.4

ibmdominoMatch8.5.3.5

ibmdominoMatch8.5.3.6

Node

ibmdominoMatch8.5.2

ibmdominoMatch8.5.2.1

ibmdominoMatch8.5.2.2

ibmdominoMatch8.5.2.3

ibmdominoMatch8.5.2.4

Node

ibmdominoMatch8.5.1

ibmdominoMatch8.5.1.1

ibmdominoMatch8.5.1.2

ibmdominoMatch8.5.1.3

ibmdominoMatch8.5.1.4

ibmdominoMatch8.5.1.5

Node

ibmdominoMatch8.5.0

Node

ibmdominoMatch9.0.1

ibmdominoMatch9.0.1.1

ibmdominoMatch9.0.1.2

ibmdominoMatch9.0.1.3

ibmdominoMatch9.0.1.4

ibmdominoMatch9.0.1.5

VendorProductVersionCPE
ibmdomino8.5.3cpe:2.3:a:ibm:domino:8.5.3:*:*:*:*:*:*:*
ibmdomino8.5.3.1cpe:2.3:a:ibm:domino:8.5.3.1:*:*:*:*:*:*:*
ibmdomino8.5.3.2cpe:2.3:a:ibm:domino:8.5.3.2:*:*:*:*:*:*:*
ibmdomino8.5.3.3cpe:2.3:a:ibm:domino:8.5.3.3:*:*:*:*:*:*:*
ibmdomino8.5.3.4cpe:2.3:a:ibm:domino:8.5.3.4:*:*:*:*:*:*:*
ibmdomino8.5.3.5cpe:2.3:a:ibm:domino:8.5.3.5:*:*:*:*:*:*:*
ibmdomino8.5.3.6cpe:2.3:a:ibm:domino:8.5.3.6:*:*:*:*:*:*:*
ibmdomino8.5.2cpe:2.3:a:ibm:domino:8.5.2:*:*:*:*:*:*:*
ibmdomino8.5.2.1cpe:2.3:a:ibm:domino:8.5.2.1:*:*:*:*:*:*:*
ibmdomino8.5.2.2cpe:2.3:a:ibm:domino:8.5.2.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	domino	8.5.3	cpe:2.3:a:ibm:domino:8.5.3:::::::*
ibm	domino	8.5.3.1	cpe:2.3:a:ibm:domino:8.5.3.1:::::::*
ibm	domino	8.5.3.2	cpe:2.3:a:ibm:domino:8.5.3.2:::::::*
ibm	domino	8.5.3.3	cpe:2.3:a:ibm:domino:8.5.3.3:::::::*
ibm	domino	8.5.3.4	cpe:2.3:a:ibm:domino:8.5.3.4:::::::*
ibm	domino	8.5.3.5	cpe:2.3:a:ibm:domino:8.5.3.5:::::::*
ibm	domino	8.5.3.6	cpe:2.3:a:ibm:domino:8.5.3.6:::::::*
ibm	domino	8.5.2	cpe:2.3:a:ibm:domino:8.5.2:::::::*
ibm	domino	8.5.2.1	cpe:2.3:a:ibm:domino:8.5.2.1:::::::*
ibm	domino	8.5.2.2	cpe:2.3:a:ibm:domino:8.5.2.2:::::::*

Rows per page:

1-10 of 251

References

www-01.ibm.com/support/docview.wss?uid=swg21983328

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.018

Percentile

88.4%

JSON

Related for CVE-2016-0304