Detections
Analytics
IBM Lotus Domino ?open Forced Directory Listing
medium Nessus Plugin ID 10057
Language:
Synopsis
Databases can be browsed on the remote web server.Description
It is possible to browse the remote web server directories by appending '?open' to the end of the URL. For example :http://www.example.com/?open
Data that can be accessed by unauthorized users may include usernames, server names and IP addresses, dial-up server phone numbers, administration logs, files names, and data files (including credit card information, proprietary corporate data, and other information stored in eCommerce related databases.) In some instances, it may be possible for an unauthorized user to modify these files or perform server administration functions via the web administration interface.
Solution
Disable the database browsing. To do this :1. From the Domino Administrator, select the Configuration tab, and open the Server document,
2. Select Internet Protocols - HTTP tab,
3. In the 'Allow HTTP clients to browse databases' field, choose No,
4. Save the document.
See Also
Plugin Details
Severity: Medium
ID: 10057
File Name: domino.nasl
Version: 1.44
Type: remote
Family: Web Servers
Published: 7/9/1999
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Vulnerability Information
CPE: cpe:/a:ibm:lotus_domino
Vulnerability Publication Date: 10/21/2001