Vulnerability Details : CVE-2004-0480

Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via a notes: URI that uses a UNC network share pathname to provide an alternate notes.ini configuration file to notes.exe.

Vulnerability category: Execute code

Published 2004-12-06 05:00:00

Updated 2017-07-11 01:30:12

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2004-0480

Probability of exploitation activity in the next 30 days: 80.10%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 98 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2004-0480

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	[email protected]
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

References for CVE-2004-0480

https://exchange.xforce.ibmcloud.com/vulnerabilities/16496
http://www-1.ibm.com/support/docview.wss?rs=475/context=SSKTWP&uid=swg21169510

Patch;Vendor Advisory
http://www.idefense.com/application/poi/display?id=111&type=vulnerabilities

Exploit;Patch;Vendor Advisory
http://www.securityfocus.com/bid/10600

Patch;Vendor Advisory
http://marc.info/?l=bugtraq&m=108843896506099&w=2

Products affected by CVE-2004-0480

IBM » Lotus Notes » Version: 6.0.3
cpe:2.3:a:ibm:lotus_notes:6.0.3:*:*:*:*:*:*:*
Matching versions
IBM » Lotus Notes » Version: 6.5
cpe:2.3:a:ibm:lotus_notes:6.5:*:*:*:*:*:*:*
Matching versions
IBM » Lotus Notes » Version: 6.5.1
cpe:2.3:a:ibm:lotus_notes:6.5.1:*:*:*:*:*:*:*
Matching versions
IBM » Lotus Notes » Version: 6.0
cpe:2.3:a:ibm:lotus_notes:6.0:*:*:*:*:*:*:*
Matching versions
IBM » Lotus Notes » Version: 6.0.1
cpe:2.3:a:ibm:lotus_notes:6.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Lotus Notes » Version: 6.0.2
cpe:2.3:a:ibm:lotus_notes:6.0.2:*:*:*:*:*:*:*
Matching versions