CVE-2007-0977

published 2007-02-16

CVE-2007-0977: IBM Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores HTTPPassword hashes from names.nsf in a manner accessible through…

Priority P3 38 high 7.1 CVSS 2.0

AV N AC M Au N C C I N A N

EXPLOIT

IBM Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores HTTPPassword hashes from names.nsf in a manner accessible through Readviewentries and OpenDocument requests to the defaultview view, a different vector than CVE-2005-2428.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
ibm	lotus_domino	—	—
ibm	lotus_domino	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://<host>/names.nsf/$defaultview?Readviewentries&Start=<n>↗

url http://<host>/names.nsf/$defaultview/<unid>?OpenDocument↗

path /names.nsf↗

• → Detect exploitation attempts by monitoring HTTP requests containing both '/names.nsf/' and 'Readviewentries' query parameter, especially targeting '$defaultview'. ↗
• → Alert on HTTP requests to '/names.nsf/$defaultview/<UNID>?OpenDocument' — this pattern is used to retrieve individual user records containing HTTPPassword hashes. ↗
• → Sequential paginated requests to '?Readviewentries&Start=<incrementing integer>' against names.nsf are characteristic of automated hash-dumping enumeration; alert on rapid sequential access with incrementing Start values. ↗
• → The Metasploit auxiliary module 'scanner/lotus/lotus_domino_hashes' targets this vulnerability; detect its use via known Metasploit User-Agent strings or the specific request pattern against names.nsf. ↗

• · The vulnerability is only exploitable when the Domino WebMail option 'Generate HTML for all fields' is enabled. Disabling this setting prevents exposure of HTTPPassword hashes in HTML output. ↗
• · The exploit script notes it 'may require some changes to properly work with your configuration', indicating environment-specific tuning may affect detection fidelity. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.