CVE-2005-2428

Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote…

published August 3, 2005

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.5th percentile for exploit probability.

CVSS
—
EPSS
73%
Percentile
99.5
In the wild
Unconfirmed
What it is

Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as (1) the password hash in the HTTPPassword field, (2) the password change date in the HTTPPasswordChangeDate field, (3) the client platform in the ClntPltfrm field, (4) the client machine name in the ClntMachine field, and (5) the client Lotus Domino release in the ClntBld field, a different vulnerability than CVE-2005-2696.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.73028 · 99.5th percentile
Published
2005-08-03T04:00Z
EPSS history
Timeline
  • 03 AUG 04:00Z
    Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote…
    cvelistv5