CVE-2011-1370 (GCVE-0-2011-1370)
Vulnerability from cvelistv5 – Published: 2011-10-29 10:00 – Updated: 2024-08-06 22:21
VLAI?
Summary
The default configuration of the Sametime configuration servlet (SCS) in the server in IBM Lotus Sametime 7.0 through 8.5.2 does not enable an authentication requirement, which allows remote attackers to read the configuration settings by examining a response message.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T22:21:34.346Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "lotussametime-configserv-info-disclosure(70923)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70923"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21569452"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-10-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The default configuration of the Sametime configuration servlet (SCS) in the server in IBM Lotus Sametime 7.0 through 8.5.2 does not enable an authentication requirement, which allows remote attackers to read the configuration settings by examining a response message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "lotussametime-configserv-info-disclosure(70923)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70923"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21569452"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-1370",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The default configuration of the Sametime configuration servlet (SCS) in the server in IBM Lotus Sametime 7.0 through 8.5.2 does not enable an authentication requirement, which allows remote attackers to read the configuration settings by examining a response message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "lotussametime-configserv-info-disclosure(70923)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70923"
},
{
"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21569452",
"refsource": "CONFIRM",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21569452"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-1370",
"datePublished": "2011-10-29T10:00:00",
"dateReserved": "2011-03-10T00:00:00",
"dateUpdated": "2024-08-06T22:21:34.346Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:lotus_sametime:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D39A4223-0F4B-4E29-A661-F8E4B1AC9785\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:lotus_sametime:7.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8C5FF0F3-D0E6-4933-8826-50C5584D0615\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:lotus_sametime:7.5.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"37FA50A4-0623-460F-A461-98BE75B1ABA1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:lotus_sametime:7.5.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0C2F7120-CD96-4817-97C3-470FC21B75B8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:lotus_sametime:7.5.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3F4F2D5C-9480-4341-A2B6-7B28DB00EACD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:lotus_sametime:7.5.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1944959C-CB01-4007-BCB0-A76AC4AA7E0B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:lotus_sametime:8.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6200D391-5317-4CF5-828F-5FB68C3B45E2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:lotus_sametime:8.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"71EB8C02-5EA3-4E16-8834-064AE4208BAA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:lotus_sametime:8.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"802AC4A0-7A7A-44B4-8422-A3015D750493\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:lotus_sametime:8.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"248C93BA-B1CA-41BF-AF1C-14D0E94CC0D2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:lotus_sametime:8.5.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F8112891-92F2-4EB9-9BBF-6FAB0C415368\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:lotus_sametime:8.5.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"15F87653-1AF5-4F84-9132-0B51AE6058EB\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"The default configuration of the Sametime configuration servlet (SCS) in the server in IBM Lotus Sametime 7.0 through 8.5.2 does not enable an authentication requirement, which allows remote attackers to read the configuration settings by examining a response message.\"}, {\"lang\": \"es\", \"value\": \"La configuraci\\u00f3n por defecto del servlet de configuraci\\u00f3n de Sametime (SCS) del servidor de IBM Lotus Sametime 7.0 hasta la versi\\u00f3n 8.5.2 no habilita el requisito de autenticaci\\u00f3n, lo que permite a atacantes remotos leer las opciones de configuraci\\u00f3n examinando un mensaje de respuesta.\"}]",
"id": "CVE-2011-1370",
"lastModified": "2024-11-21T01:26:10.027",
"metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2011-10-29T10:55:08.273",
"references": "[{\"url\": \"http://www-01.ibm.com/support/docview.wss?uid=swg21569452\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/70923\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www-01.ibm.com/support/docview.wss?uid=swg21569452\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/70923\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-16\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2011-1370\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2011-10-29T10:55:08.273\",\"lastModified\":\"2025-04-11T00:51:21.963\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The default configuration of the Sametime configuration servlet (SCS) in the server in IBM Lotus Sametime 7.0 through 8.5.2 does not enable an authentication requirement, which allows remote attackers to read the configuration settings by examining a response message.\"},{\"lang\":\"es\",\"value\":\"La configuraci\u00f3n por defecto del servlet de configuraci\u00f3n de Sametime (SCS) del servidor de IBM Lotus Sametime 7.0 hasta la versi\u00f3n 8.5.2 no habilita el requisito de autenticaci\u00f3n, lo que permite a atacantes remotos leer las opciones de configuraci\u00f3n examinando un mensaje de respuesta.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-16\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:lotus_sametime:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D39A4223-0F4B-4E29-A661-F8E4B1AC9785\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:lotus_sametime:7.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C5FF0F3-D0E6-4933-8826-50C5584D0615\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:lotus_sametime:7.5.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"37FA50A4-0623-460F-A461-98BE75B1ABA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:lotus_sametime:7.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C2F7120-CD96-4817-97C3-470FC21B75B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:lotus_sametime:7.5.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F4F2D5C-9480-4341-A2B6-7B28DB00EACD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:lotus_sametime:7.5.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1944959C-CB01-4007-BCB0-A76AC4AA7E0B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:lotus_sametime:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6200D391-5317-4CF5-828F-5FB68C3B45E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:lotus_sametime:8.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"71EB8C02-5EA3-4E16-8834-064AE4208BAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:lotus_sametime:8.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"802AC4A0-7A7A-44B4-8422-A3015D750493\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:lotus_sametime:8.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"248C93BA-B1CA-41BF-AF1C-14D0E94CC0D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:lotus_sametime:8.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F8112891-92F2-4EB9-9BBF-6FAB0C415368\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:lotus_sametime:8.5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"15F87653-1AF5-4F84-9132-0B51AE6058EB\"}]}]}],\"references\":[{\"url\":\"http://www-01.ibm.com/support/docview.wss?uid=swg21569452\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/70923\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www-01.ibm.com/support/docview.wss?uid=swg21569452\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/70923\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…