CVE-2009-5033
IBM Lotus Notes Traveler < 8.5.0.1 - Authenticated Exposure of Sensitive Information via Sync Operation
Title source: llmDescription
IBM Lotus Notes Traveler before 8.5.0.2 does not properly handle a "* *" argument sequence for a certain tell command, which allows remote authenticated users to obtain access to other users' data via a sync operation, related to storage of the data of multiple users within the same thread.
References (4)
Core 4
Core References
Various Sources x_refsource_confirm
http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/64742
Vendor Advisory vendor-advisory
x_refsource_aixapar
http://www-1.ibm.com/support/docview.wss?uid=swg1LO41040
Various Sources x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg24019529&aid=1
Scores
EPSS
0.0099
EPSS Percentile
58.4%
Details
CWE
CWE-200
Status
published
Products (6)
ibm/lotus_notes_traveler
8.0
ibm/lotus_notes_traveler
8.0.1
ibm/lotus_notes_traveler
8.0.1.2
ibm/lotus_notes_traveler
8.0.1.3
ibm/lotus_notes_traveler
8.5.0.0
ibm/lotus_notes_traveler
< 8.5.0.1
Published
Dec 16, 2010
Tracked Since
Feb 18, 2026