CVE-2006-4763 — IBM Lotus Domino WEB Access vulnerability

3 documents3 sources

Severity

7.5HIGHNVD

EPSS

1.6%

top 18.03%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Lotus Domino WEB Access

Timeline

PublishedSep 13

Latest updateMay 1

Description

IBM Lotus Domino Web Access (DWA) 7.0.1 does not expire a client's Lightweight Third-Party Authentication token (LtpaToken) upon logout, which allows remote attackers to obtain a user's privileges by intercepting the LtpaToken cookie.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

▶NVDibm/lotus_domino_web_access7.0.1

🔴Vulnerability Details

GHSA

GHSA-hr6h-72x5-mmrx: IBM Lotus Domino Web Access (DWA) 7↗2022-05-01

▶

CVEList

CVE-2006-4763: IBM Lotus Domino Web Access (DWA) 7↗2006-09-13

▶