Detections
Analytics
IBM Domino 8.5.x < 8.5.3 FP6 iNotes Multiple XSS (uncredentialed check)
medium Nessus Plugin ID 71858
Language:
Synopsis
The remote server is affected by multiple cross-site scripting vulnerabilities.Description
According to its banner, the version of IBM Domino (formerly IBM Lotus Domino) on the remote host is 8.5.x prior to 8.5.3 FP6. It is, therefore, affected by the following iNotes-related cross-site scripting vulnerabilities :- An input validation error exists related to handling content in email messages. (CVE-2013-4063)
- An input validation error exists related to iNotes when running in 'ultra-light' mode. (CVE-2013-4064)
- An input validation error exists related to handling content in email messages and iNotes when running in 'ultra-light' mode. (CVE-2013-4065)
Solution
Upgrade to IBM Domino 8.5.3 FP6 or later.See Also
http://www-01.ibm.com/support/docview.wss?uid=swg24032242#FP6
Plugin Details
Severity: Medium
ID: 71858
File Name: domino_8_5_3fp6.nasl
Version: 1.4
Type: remote
Family: Misc.
Published: 1/8/2014
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.0
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:ibm:lotus_domino
Required KB Items: Domino/Version
Exploit Ease: No known exploits are available
Patch Publication Date: 12/9/2013
Vulnerability Publication Date: 12/17/2013