CVE-2004-1621
Cross-site scripting (XSS) vulnerability in IBM Lotus Notes R6 and Domino R6, and possibly earlier versions, allows remote attackers to execute arbitrary web script or HTML via square brackets at the beginning and end of (1) computed for display, (2)…
Does this matter?
Lower severity and a low EPSS score (3.08%). Track it; it rarely justifies an emergency change on its own.
Description
NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in IBM Lotus Notes R6 and Domino R6, and possibly earlier versions, allows remote attackers to execute arbitrary web script or HTML via square brackets at the beginning and end of (1) computed for display, (2) computed when composed, or (3) computed text element fields. NOTE: the vendor has disputed this issue, saying that it is not a problem with Notes/Domino itself, but with the applications that do not properly handle this feature
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 3.08% probability · 87th percentile
- CISA KEV
- Not listed
- Affected
- ibm/lotus domino
- Source
- cve@mitre.org
References
- http://marc.info/?l=bugtraq&m=109812960023736&w=2
- http://marc.info/?l=bugtraq&m=109841682529328&w=2
- http://secunia.com/advisories/12891Exploit, Vendor Advisory
- http://securitytracker.com/id?1011779Exploit, Vendor Advisory
- http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21187833Exploit, Vendor Advisory
- http://www.kb.cert.org/vuls/id/404382US Government Resource
- http://www.securityfocus.com/bid/11458Exploit, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17758
- http://marc.info/?l=bugtraq&m=109812960023736&w=2
- http://marc.info/?l=bugtraq&m=109841682529328&w=2
- http://secunia.com/advisories/12891Exploit, Vendor Advisory
- http://securitytracker.com/id?1011779Exploit, Vendor Advisory
- http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21187833Exploit, Vendor Advisory
- http://www.kb.cert.org/vuls/id/404382US Government Resource
- http://www.securityfocus.com/bid/11458Exploit, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17758
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.