IBM Lotus Domino 8.5.4 / 8.5.3 Cross Site Scripting

Type packetstorm
Reporter MustLive
Modified 2015-05-28T00:00:00


                                            `Hello list!  
I want to warn you about Cross-Site Scripting vulnerability in IBM Domino.   
This is one from many vulnerabilities in Domino, which I've found at   
03.05.2012. In previous years I wrote about multiple vulnerabilities in   
Lotus Domino ( and Lotus Notes   
Traveler (  
During 2012-2013 I informed IBM that have other holes in Domino (as this   
XSS), besides previous holes, but they were not interested.  
Affected products:  
Vulnerable are IBM Lotus Domino 8.5.3, 8.5.4 (in which I tested) and   
previous versions. Versions Domino 9.0 and 9.0.1 also must be vulnerable   
(since IBM hasn't fix it earlier).  
Affected vendors:  
IBM Domino (formerly IBM Lotus Domino)  
Cross-Site Scripting (WASC-08):  
For conducting XSS attack it's needed to know hashes in address of a letter.   
They can be found via information leakage (i.e. embedded image) or via other   
XSS vulnerability.  
Full timeline read in the first advisory   
- During 16.05-20.05.2012 I've wrote announcements about multiple   
vulnerabilities in IBM software at my site.  
- During 16.05-20.05.2012 I've wrote five advisories via contact form at IBM   
- At 31.05.2012 I've resend five advisories to IBM PSIRT, which they   
received and said they would send them to the developers (of Lotus   
- At 18.08.2012 I've reminded IBM about multiple holes and gave enough   
arguments to fix them.  
- At 14.04.2013 I've again remind IBM about Brute Force and Insufficient   
Authentication holes.  
- At 23.04.2013 IBM answered that they would not fix Brute Force and   
Insufficient Authentication holes and don't interested in this XSS.  
- During 15.02.2013-26.04.2013 I disclosed at my site about previous   
vulnerabilities IBM Lotus Domino.  
- At 26.05.2015 I've disclosed this vulnerability at my site   
Best wishes & regards,  
Administrator of Websecurity web site