CVE-2010-0920 : Cross-site scripting (XSS) vulnerability in IBM Lotus iNotes (aka Domino Web Acc

Cross-site scripting (XSS) vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.281 for Domino 8.0.2 FP4 allows remote attackers to inject arbitrary web script or HTML via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."

Published 2010-03-03 19:30:01

Updated 2025-04-11 00:51:22

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)Cross-site request forgery (CSRF)

Products affected by CVE-2010-0920

IBM » Lotus Inotes
Versions up to, including, (<=) 229.271
cpe:2.3:a:ibm:lotus_inotes:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.021
cpe:2.3:a:ibm:lotus_inotes:229.021:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.011
cpe:2.3:a:ibm:lotus_inotes:229.011:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.041
cpe:2.3:a:ibm:lotus_inotes:229.041:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.031
cpe:2.3:a:ibm:lotus_inotes:229.031:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.101
cpe:2.3:a:ibm:lotus_inotes:229.101:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.061
cpe:2.3:a:ibm:lotus_inotes:229.061:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.051
cpe:2.3:a:ibm:lotus_inotes:229.051:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.191
cpe:2.3:a:ibm:lotus_inotes:229.191:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.181
cpe:2.3:a:ibm:lotus_inotes:229.181:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.211
cpe:2.3:a:ibm:lotus_inotes:229.211:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.201
cpe:2.3:a:ibm:lotus_inotes:229.201:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.131
cpe:2.3:a:ibm:lotus_inotes:229.131:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.111
cpe:2.3:a:ibm:lotus_inotes:229.111:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.171
cpe:2.3:a:ibm:lotus_inotes:229.171:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.161
cpe:2.3:a:ibm:lotus_inotes:229.161:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.221
cpe:2.3:a:ibm:lotus_inotes:229.221:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.151
cpe:2.3:a:ibm:lotus_inotes:229.151:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.141
cpe:2.3:a:ibm:lotus_inotes:229.141:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.241
cpe:2.3:a:ibm:lotus_inotes:229.241:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.261
cpe:2.3:a:ibm:lotus_inotes:229.261:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.251
cpe:2.3:a:ibm:lotus_inotes:229.251:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4
IBM » Lotus Inotes » Version: 229.231
cpe:2.3:a:ibm:lotus_inotes:229.231:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Lotus Domino » Version: 8.0.2.4

Exploit prediction scoring system (EPSS) score for CVE-2010-0920

EPSS FAQ

0.29%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 49 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2010-0920

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2010-0920

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2010-0920

http://www.vupen.com/english/advisories/2010/0496

Webmail | OVH- OVH
Vendor Advisory

CVEs referencing this url
http://www-01.ibm.com/support/docview.wss?uid=swg27018109

Lotus iNotes Interim Fix 229.281 for Domino 8.0.2 Fix Pack 4
Vendor Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/38459

IBM Domino Web Access Prior to 229.281 Unspecified Security Vulnerabilities

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2010-0920

Products affected by CVE-2010-0920

Exploit prediction scoring system (EPSS) score for CVE-2010-0920

CVSS scores for CVE-2010-0920

CWE ids for CVE-2010-0920

References for CVE-2010-0920