fkie_cve-2010-0921
Vulnerability from fkie_nvd
Published
2010-03-03 19:30
Modified
2025-04-11 00:51
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.281 for Domino 8.0.2 FP4 allows remote attackers to hijack the authentication of unspecified victims via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."
References
cve@mitre.orghttp://www-01.ibm.com/support/docview.wss?uid=swg27018109
cve@mitre.orghttp://www.securityfocus.com/bid/38459
cve@mitre.orghttp://www.vupen.com/english/advisories/2010/0496Vendor Advisory
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/56556
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg27018109
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/38459
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2010/0496Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/56556
Impacted products
Vendor Product Version
ibm lotus_inotes *
ibm lotus_inotes 229.011
ibm lotus_inotes 229.021
ibm lotus_inotes 229.031
ibm lotus_inotes 229.041
ibm lotus_inotes 229.051
ibm lotus_inotes 229.061
ibm lotus_inotes 229.101
ibm lotus_inotes 229.111
ibm lotus_inotes 229.131
ibm lotus_inotes 229.141
ibm lotus_inotes 229.151
ibm lotus_inotes 229.161
ibm lotus_inotes 229.171
ibm lotus_inotes 229.181
ibm lotus_inotes 229.191
ibm lotus_inotes 229.201
ibm lotus_inotes 229.211
ibm lotus_inotes 229.221
ibm lotus_inotes 229.231
ibm lotus_inotes 229.241
ibm lotus_inotes 229.251
ibm lotus_inotes 229.261
ibm lotus_domino 8.0.2.4


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DA92AB06-5510-4109-AE3A-75834E5F8A00",
              "versionEndIncluding": "229.271",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.011:*:*:*:*:*:*:*",
              "matchCriteriaId": "62AF2DA6-98E4-4921-B36C-AA5771B3629E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.021:*:*:*:*:*:*:*",
              "matchCriteriaId": "3CC0B87F-B742-466D-BF93-56BFECAC2E54",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.031:*:*:*:*:*:*:*",
              "matchCriteriaId": "708BEAEF-B186-470D-8148-9C0703B42765",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.041:*:*:*:*:*:*:*",
              "matchCriteriaId": "83C58751-33AE-4A3F-A096-AB13FC8A64A2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.051:*:*:*:*:*:*:*",
              "matchCriteriaId": "01E2E70E-3C00-4AA2-AF8D-349E82806FA3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.061:*:*:*:*:*:*:*",
              "matchCriteriaId": "3508BE09-6B84-4819-BC0F-7E23964FE29D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.101:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A17FFE5-97F5-45D0-8C54-3C22BF1FFA72",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.111:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE8C8052-8980-4265-929B-E27B6A914B4F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.131:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D6C0F89-47E6-4895-909D-6AF8DBFE2477",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.141:*:*:*:*:*:*:*",
              "matchCriteriaId": "590EBAF8-04A9-4DAD-9FCF-B1B38FF03374",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.151:*:*:*:*:*:*:*",
              "matchCriteriaId": "717F7305-98E1-403D-B08A-6FE1FD83D2C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.161:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C4B46DA-B4E6-4AB0-AD85-7C77EFE14063",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.171:*:*:*:*:*:*:*",
              "matchCriteriaId": "E1862CF3-0BF2-4F1B-80A9-0B5B02005A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.181:*:*:*:*:*:*:*",
              "matchCriteriaId": "1CC9488A-F368-498E-8CDE-2ADC6AED470B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.191:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2F8C056-91A2-410B-942A-E108B93AD1E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.201:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCD1A2BB-F7FC-4FE1-B633-F0AF79E0F5FB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.211:*:*:*:*:*:*:*",
              "matchCriteriaId": "805C7074-679E-4F11-A055-8C52B4E26F5F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.221:*:*:*:*:*:*:*",
              "matchCriteriaId": "840A1975-0C5B-44F0-9F2E-1BBE02AA0484",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.231:*:*:*:*:*:*:*",
              "matchCriteriaId": "33A29245-F9DA-4F77-91EE-21C1FA3CE784",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.241:*:*:*:*:*:*:*",
              "matchCriteriaId": "B55ED49B-092B-411B-84AE-847770EE096B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.251:*:*:*:*:*:*:*",
              "matchCriteriaId": "483C2E2D-424C-453B-9D51-F53C6B32178B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:lotus_inotes:229.261:*:*:*:*:*:*:*",
              "matchCriteriaId": "4348F385-9AE1-4F8C-9F22-BE50FCA3710B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:lotus_domino:8.0.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F936FD55-AD59-47B3-8591-3F79B2ABB4E9",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.281 for Domino 8.0.2 FP4 allows remote attackers to hijack the authentication of unspecified victims via vectors related to lack of \"XSS/CSRF Get Filter and Referer Check fixes.\""
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en IBM Lotus iNotes (alias Domino Web Access o DWA) en versiones anteriores a la 229.281 para Domino 8.0.2 FP4 permite a atacantes remotos secuestrar la autenticaci\u00f3n de vict\u00edmas al azar mediante vectores relacionados con la falta de \"XSS/CSRF Get Filter and Referer Check fixes.\""
    }
  ],
  "id": "CVE-2010-0921",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2010-03-03T19:30:00.820",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27018109"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/38459"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2010/0496"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56556"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27018109"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/38459"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2010/0496"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56556"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.