Описание
Argument injection vulnerability in IBM Lotus Notes 8.0.x before 8.0.2 FP6 and 8.5.x before 8.5.1 FP5 allows remote attackers to execute arbitrary code via a cai:// URL containing a --launcher.library option that specifies a UNC share pathname for a DLL file, aka SPR PRAD82YJW2.
Ссылки
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:ibm:lotus_notes:8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.0.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.0.2.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.0.2.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.0.2.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.0.2.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.0.2.5:*:*:*:*:*:*:*
Конфигурация 2
Одно из
cpe:2.3:a:ibm:lotus_notes:8.5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.5.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.5.1.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.5.1.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.5.1.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:lotus_notes:8.5.1.4:*:*:*:*:*:*:*
EPSS
Процентиль: 82%
0.01713
Низкий
9.3 Critical
CVSS2
Дефекты
CWE-20
Связанные уязвимости
github
больше 3 лет назад
Argument injection vulnerability in IBM Lotus Notes 8.0.x before 8.0.2 FP6 and 8.5.x before 8.5.1 FP5 allows remote attackers to execute arbitrary code via a cai:// URL containing a --launcher.library option that specifies a UNC share pathname for a DLL file, aka SPR PRAD82YJW2.
EPSS
Процентиль: 82%
0.01713
Низкий
9.3 Critical
CVSS2
Дефекты
CWE-20