The Evaluate LotusScript method in IBM Lotus Domino before 7.0.3 uses an incorrect security context for @ formula commands in some circumstances, which might allow remote authenticated users to gain privileges and obtain sensitive information.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Lotus_domino | Ibm | 6.5.5 (including) | 6.5.5 (including) |
| Lotus_domino | Ibm | 6.5.6 (including) | 6.5.6 (including) |
| Lotus_domino | Ibm | 7.0 (including) | 7.0 (including) |
| Lotus_domino | Ibm | 7.0.2 (including) | 7.0.2 (including) |
References
- http://osvdb.org/40951
- http://secunia.com/advisories/27321
- http://www-1.ibm.com/support/docview.wss?uid=swg21273266
- http://www.securityfocus.com/bid/26176
- http://www.vupen.com/english/advisories/2007/3598
- https://exchange.xforce.ibmcloud.com/vulnerabilities/37369
- http://osvdb.org/40951
- http://secunia.com/advisories/27321
- http://www-1.ibm.com/support/docview.wss?uid=swg21273266
- http://www.securityfocus.com/bid/26176
- http://www.vupen.com/english/advisories/2007/3598
- https://exchange.xforce.ibmcloud.com/vulnerabilities/37369