VulnerabilityModified

CVE-2004-0480

Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via a notes: URI that uses a UNC network share pathname to provide an alternate notes.ini configuration file to notes.exe.

HIGH 10.0EPSS 8.65%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (8.65%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 2.0: 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS: 8.65% probability · 95th percentile
CISA KEV: Not listed
Weakness: CWE-88
Affected: ibm/lotus notes
Source: cve@mitre.org

References

http://marc.info/?l=bugtraq&m=108843896506099&w=2Third Party Advisory
http://www-1.ibm.com/support/docview.wss?rs=475/context=SSKTWP&uid=swg21169510Broken Link, Patch, Vendor Advisory
http://www.idefense.com/application/poi/display?id=111&type=vulnerabilitiesBroken Link, Exploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/10600Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16496Third Party Advisory, VDB Entry
http://marc.info/?l=bugtraq&m=108843896506099&w=2Third Party Advisory
http://www-1.ibm.com/support/docview.wss?rs=475/context=SSKTWP&uid=swg21169510Broken Link, Patch, Vendor Advisory
http://www.idefense.com/application/poi/display?id=111&type=vulnerabilitiesBroken Link, Exploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/10600Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16496Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.