CVE-2001-1567

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2001-12-31 · updated 2026-06-16

Description

Lotus Domino server 5.0.9a and earlier allows remote attackers to bypass security restrictions and view Notes database files and possibly sensitive Notes template files (.ntf) via an HTTP request with a large number of "+" characters before the .nsf file extension, which are converted to spaces by Domino.

Affected products

IBM Lotus Domino: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5 (+5)
IBM Lotus Domino Server: through 5.0.9a

References

http://marc.info/?l=bugtraq&m=101284222932568&w=2
http://marc.info/?l=bugtraq&m=101285903120879&w=2
http://marc.info/?l=bugtraq&m=101286525008089&w=2
http://www.iss.net/security_center/static/8072.php
http://www.nextgenss.com/papers/hpldws.pdf
http://www.securityfocus.com/bid/4022
http://marc.info/?l=bugtraq&m=101284222932568&w=2
http://marc.info/?l=bugtraq&m=101285903120879&w=2
http://marc.info/?l=bugtraq&m=101286525008089&w=2
http://www.iss.net/security_center/static/8072.php
http://www.nextgenss.com/papers/hpldws.pdf
http://www.securityfocus.com/bid/4022

Get alerted when CVE-2001-1567 or the next vulnerability affects your stack