Description
The default configuration of the Sametime configuration servlet (SCS) in the server in IBM Lotus Sametime 7.0 through 8.5.2 does not enable an authentication requirement, which allows remote attackers to read the configuration settings by examining a response message.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/70923
Various Sources x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21569452
Scores
EPSS
0.0114
EPSS Percentile
63.2%
Details
CWE
CWE-16
Status
published
Products (12)
ibm/lotus_sametime
7.0
ibm/lotus_sametime
7.5
ibm/lotus_sametime
7.5.0.1
ibm/lotus_sametime
7.5.1
ibm/lotus_sametime
7.5.1.1
ibm/lotus_sametime
7.5.1.2
ibm/lotus_sametime
8.0
ibm/lotus_sametime
8.0.1
ibm/lotus_sametime
8.0.2
ibm/lotus_sametime
8.5
... and 2 more
Published
Oct 29, 2011
Tracked Since
Feb 18, 2026