CVE-2006-5835

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-11-10 · updated 2026-06-16

Description

The Notes Remote Procedure Call (NRPC) protocol in IBM Lotus Notes Domino before 6.5.5 FP2 and 7.x before 7.0.2 does not require authentication to perform user lookups, which allows remote attackers to obtain the user ID file.

Affected products

IBM Lotus Notes: 5.0.3, 5.0.12, 6.0, 6.0.1, 6.0.2, 6.0.3 (+10)

References

http://secunia.com/advisories/22741
http://securitytracker.com/id?1017203
http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21248026
http://www.fortconsult.net/images/pdf/lotusnotes_keyfiles.pdf
http://www.securityfocus.com/bid/20960
http://www.vupen.com/english/advisories/2006/4411
https://exchange.xforce.ibmcloud.com/vulnerabilities/30118
http://secunia.com/advisories/22741
http://securitytracker.com/id?1017203
http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21248026
http://www.fortconsult.net/images/pdf/lotusnotes_keyfiles.pdf
http://www.securityfocus.com/bid/20960

Get alerted when CVE-2006-5835 or the next vulnerability affects your stack