CVE-2004-0480: ibm lotus_notes Argument Injection

Vulnerability summary

CVE-2004-0480 is a high (CVSS 10.0) Argument Injection vulnerability in ibm lotus_notes. EPSS estimates a 8.65% chance of exploitation in the next 30 days, higher than 95% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 30-06-2004
   PublishedVulnerability first disclosed.
2. 08-08-2024
   Last modifiedVulnerability information updated.

Description

Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via a notes: URI that uses a UNC network share pathname to provide an alternate notes.ini configuration file to notes.exe.

• CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.