CVE-2008-1965

2008-04-2519:05:00

CWE-94

[email protected]

web.nvd.nist.gov

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.7

Confidence

Low

EPSS

0.926

Percentile

99.0%

JSON

Argument injection vulnerability in the cai: URI handler in rcplauncher in IBM Lotus Expeditor Client for Desktop 6.1.1 and 6.1.2, as used by Lotus Symphony and possibly other products, allows remote attackers to execute arbitrary code by injecting a -launcher option via a cai: URI, as demonstrated by a reference to a UNC share pathname.

Affected configurations

Nvd

Node

ibmlotus_expeditor_clientMatch6.1.1desktop

ibmlotus_expeditor_clientMatch6.1.2desktop

ibmlotus_symphany

VendorProductVersionCPE
ibmlotus_expeditor_client6.1.1cpe:2.3:a:ibm:lotus_expeditor_client:6.1.1:*:desktop:*:*:*:*:*
ibmlotus_expeditor_client6.1.2cpe:2.3:a:ibm:lotus_expeditor_client:6.1.2:*:desktop:*:*:*:*:*
ibmlotus_symphany*cpe:2.3:a:ibm:lotus_symphany:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	lotus_expeditor_client	6.1.1	cpe:2.3:a:ibm:lotus_expeditor_client:6.1.1::desktop:::::
ibm	lotus_expeditor_client	6.1.2	cpe:2.3:a:ibm:lotus_expeditor_client:6.1.2::desktop:::::
ibm	lotus_symphany	*	cpe:2.3:a:ibm:lotus_symphany::::::::