CVE-2008-7253
The default configuration of the web server in IBM Lotus Domino Server, possibly 6.0 through 8.0, enables the HTTP TRACE method, which makes it easier for remote attackers to steal cookies and authentication credentials via a cross-site tracing (XST)…
Does this matter?
Lower severity and a low EPSS score (2.09%). Track it; it rarely justifies an emergency change on its own.
Description
The default configuration of the web server in IBM Lotus Domino Server, possibly 6.0 through 8.0, enables the HTTP TRACE method, which makes it easier for remote attackers to steal cookies and authentication credentials via a cross-site tracing (XST) attack, a related issue to CVE-2004-2763 and CVE-2005-3398.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 2.09% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-16
- Affected
- ibm/lotus domino server
- Source
- cve@mitre.org
References
- http://www-01.ibm.com/support/docview.wss?&uid=swg21201202
- http://www.kb.cert.org/vuls/id/867593US Government Resource
- http://www.kb.cert.org/vuls/id/AAMN-5K42VN
- http://www.kb.cert.org/vuls/id/AAMN-5K42VT
- http://www-01.ibm.com/support/docview.wss?&uid=swg21201202
- http://www.kb.cert.org/vuls/id/867593US Government Resource
- http://www.kb.cert.org/vuls/id/AAMN-5K42VN
- http://www.kb.cert.org/vuls/id/AAMN-5K42VT
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.