CVE-2012-3302

IBM Lotus Domino 7.x-8.x - Cross-Site Scripting via Mail Template or Help URL

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Domino 7.x and 8.x before 8.5.4 allow remote attackers to inject arbitrary web script or HTML via (1) a URL accessed during use of the Mail template in the WebMail UI or (2) a URL accessed during use of Domino Help through the Domino HTTP server.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21608160
Various Sources x_refsource_misc
http://websecurity.com.ua/5839/
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/77401

Scores

EPSS 0.0115
EPSS Percentile 63.5%

Details

CWE
CWE-79
Status published
Products (24)
ibm/lotus_domino 7.0.1
ibm/lotus_domino 7.0.1.1
ibm/lotus_domino 7.0.2
ibm/lotus_domino 7.0.2.2
ibm/lotus_domino 7.0.3.0
ibm/lotus_domino 7.0.3.1
ibm/lotus_domino 7.0.4.0
ibm/lotus_domino 7.0.4.1
ibm/lotus_domino 7.0.4.2
ibm/lotus_domino 8.5.0
... and 14 more
Published Aug 21, 2012
Tracked Since Feb 18, 2026