Vulnerabilities > CVE-2005-2428 - Unspecified vulnerability in IBM Lotus Domino 5.0/6.0/6.5

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
ibm
nessus
exploit available
NVD
Published: 2005-08-03
Updated: 2024-11-20

Summary

Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as (1) the password hash in the HTTPPassword field, (2) the password change date in the HTTPPasswordChangeDate field, (3) the client platform in the ClntPltfrm field, (4) the client machine name in the ClntMachine field, and (5) the client Lotus Domino release in the ClntBld field, a different vulnerability than CVE-2005-2696.

Vulnerable Configurations

Part Description Count
Application
Ibm
3

Exploit-Db

  • descriptionIBM Lotus Domino. CVE-2005-2428. Webapps exploit for windows platform
    fileexploits/windows/webapps/39495.py
    idEDB-ID:39495
    last seen2016-02-26
    modified2016-02-25
    platformwindows
    port
    published2016-02-25
    reporterJonathan Broche
    sourcehttps://www.exploit-db.com/download/39495/
    titleIBM Lotus Domino <= R8 Password Hash Extraction Exploit
    typewebapps
  • descriptionLotus Domino <= R6 Webmail Remote Password Hash Dumper Exploit. CVE-2005-2428,CVE-2007-0977. Remote exploit for windows platform
    fileexploits/windows/remote/3302.sh
    idEDB-ID:3302
    last seen2016-01-31
    modified2007-02-13
    platformwindows
    port80
    published2007-02-13
    reporterMarco Ivaldi
    sourcehttps://www.exploit-db.com/download/3302/
    titleLotus Domino <= R6 Webmail Remote Password Hash Dumper Exploit
    typeremote

Nessus

NASL familyWeb Servers
NASL idDOMINO_HTTP_INFO_DISCLOSURE.NASL
descriptionThe remote host is running a version of Lotus Domino Server that is prone to several information disclosure vulnerabilities. Specifically, users
last seen2020-06-01
modified2020-06-02
plugin id19309
published2005-07-27
reporterThis script is Copyright (C) 2005-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/19309
titleIBM Lotus Domino HTML Hidden Field Encrypted Password Disclosure

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/54436/lotus.sh.txt
idPACKETSTORM:54436
last seen2016-12-05
published2007-02-14
reporterMarco Ivaldi
sourcehttps://packetstormsecurity.com/files/54436/lotus.sh.txt.html
titlelotus.sh.txt

Seebug

  • bulletinFamilyexploit
    descriptionNo description provided by source.
    idSSV:13490
    last seen2017-11-19
    modified2007-02-13
    published2007-02-13
    reporterRoot
    sourcehttps://www.seebug.org/vuldb/ssvid-13490
    titleLotus Domino &lt;= R6 Webmail Remote Password Hash Dumper Exploit
  • bulletinFamilyexploit
    descriptionNo description provided by source.
    idSSV:64478
    last seen2017-11-19
    modified2014-07-01
    published2014-07-01
    reporterRoot
    sourcehttps://www.seebug.org/vuldb/ssvid-64478
    titleLotus Domino <= R6 Webmail Remote Password Hash Dumper Exploit
  • bulletinFamilyexploit
    descriptionNo description provided by source.
    idSSV:6191
    last seen2017-11-19
    modified2007-02-14
    published2007-02-14
    reporterRoot
    sourcehttps://www.seebug.org/vuldb/ssvid-6191
    titleLotus Domino &lt;= R6 Webmail Remote Password Hash Dumper Exploit

References