CVE-2011-1370

The default configuration of the Sametime configuration servlet (SCS) in the server in IBM Lotus Sametime 7.0 through 8.5.2 does not enable an authentication requirement, which allows remote attackers to read the configuration settings by examining a response message.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21569452
https://exchange.xforce.ibmcloud.com/vulnerabilities/70923
http://www-01.ibm.com/support/docview.wss?uid=swg21569452
https://exchange.xforce.ibmcloud.com/vulnerabilities/70923

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:lotus_sametime:7.0:::::::*
	cpe:2.3:a:ibm:lotus_sametime:7.5:::::::*
	cpe:2.3:a:ibm:lotus_sametime:7.5.0.1:::::::*
	cpe:2.3:a:ibm:lotus_sametime:7.5.1:::::::*
	cpe:2.3:a:ibm:lotus_sametime:7.5.1.1:::::::*
	cpe:2.3:a:ibm:lotus_sametime:7.5.1.2:::::::*
	cpe:2.3:a:ibm:lotus_sametime:8.0:::::::*
	cpe:2.3:a:ibm:lotus_sametime:8.0.1:::::::*
	cpe:2.3:a:ibm:lotus_sametime:8.0.2:::::::*
	cpe:2.3:a:ibm:lotus_sametime:8.5:::::::*
	cpe:2.3:a:ibm:lotus_sametime:8.5.1:::::::*
	cpe:2.3:a:ibm:lotus_sametime:8.5.2:::::::*

History

No history.

Information

Published : 2011-10-29 10:55

Updated : 2025-04-11 00:51

NVD link : CVE-2011-1370

Mitre link : CVE-2011-1370

CVE.ORG link : CVE-2011-1370

JSON object : View

Products Affected

ibm

lotus_sametime

CWE

CWE-16

Configuration

{"id": "CVE-2011-1370", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-10-29T10:55:08.273", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21569452", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70923", "source": "cve@mitre.org"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21569452", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70923", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-16"}]}], "descriptions": [{"lang": "en", "value": "The default configuration of the Sametime configuration servlet (SCS) in the server in IBM Lotus Sametime 7.0 through 8.5.2 does not enable an authentication requirement, which allows remote attackers to read the configuration settings by examining a response message."}, {"lang": "es", "value": "La configuraci\u00f3n por defecto del servlet de configuraci\u00f3n de Sametime (SCS) del servidor de IBM Lotus Sametime 7.0 hasta la versi\u00f3n 8.5.2 no habilita el requisito de autenticaci\u00f3n, lo que permite a atacantes remotos leer las opciones de configuraci\u00f3n examinando un mensaje de respuesta."}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:lotus_sametime:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D39A4223-0F4B-4E29-A661-F8E4B1AC9785"}, {"criteria": "cpe:2.3:a:ibm:lotus_sametime:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C5FF0F3-D0E6-4933-8826-50C5584D0615"}, {"criteria": "cpe:2.3:a:ibm:lotus_sametime:7.5.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37FA50A4-0623-460F-A461-98BE75B1ABA1"}, {"criteria": "cpe:2.3:a:ibm:lotus_sametime:7.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C2F7120-CD96-4817-97C3-470FC21B75B8"}, {"criteria": "cpe:2.3:a:ibm:lotus_sametime:7.5.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F4F2D5C-9480-4341-A2B6-7B28DB00EACD"}, {"criteria": "cpe:2.3:a:ibm:lotus_sametime:7.5.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1944959C-CB01-4007-BCB0-A76AC4AA7E0B"}, {"criteria": "cpe:2.3:a:ibm:lotus_sametime:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6200D391-5317-4CF5-828F-5FB68C3B45E2"}, {"criteria": "cpe:2.3:a:ibm:lotus_sametime:8.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71EB8C02-5EA3-4E16-8834-064AE4208BAA"}, {"criteria": "cpe:2.3:a:ibm:lotus_sametime:8.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "802AC4A0-7A7A-44B4-8422-A3015D750493"}, {"criteria": "cpe:2.3:a:ibm:lotus_sametime:8.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "248C93BA-B1CA-41BF-AF1C-14D0E94CC0D2"}, {"criteria": "cpe:2.3:a:ibm:lotus_sametime:8.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8112891-92F2-4EB9-9BBF-6FAB0C415368"}, {"criteria": "cpe:2.3:a:ibm:lotus_sametime:8.5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15F87653-1AF5-4F84-9132-0B51AE6058EB"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}