IBM Domino ZMerge Database Security Bypass

high Nessus Plugin ID 86322

Language:

Synopsis

A remote database can be accessed without credentials.

Description

The version of IBM Domino (formerly IBM Lotus Domino) running on the remote host is affected by a security bypass vulnerability due to insufficient access control list (ACL) settings on the administration databases for ZMerge. An unauthenticated, remote attacker can exploit this issue to disclose configuration information about the IBM Domino server installation or possibly to gain manager level access.

Note that this plugin may report Domino databases without ZMerge, if the databases are found to be non-password protected.

Solution

Verify all of the ACLs for the available databases.

Plugin Details

Severity: High

ID: 86322

File Name: domino_db_no_password.nasl

Version: 1.10

Type: remote

Family: Web Servers

Published: 10/9/2015

Updated: 10/6/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2002-0664

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ibm:lotus_domino

Required KB Items: www/domino

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/6/2002

Reference Information

CVE: CVE-2002-0664

BID: 5101

Detections

Analytics