CVE-2007-5701

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-10-29 · updated 2026-06-16
Weakness: CWE-200

Description

Incomplete blacklist vulnerability in the Certificate Authority (CA) in IBM Lotus Domino before 7.0.3 allows local users, or attackers with physical access, to obtain sensitive information (passwords) when an administrator enters a "ca activate" or "ca unlock" command with any uppercase character, which bypasses a blacklist designed to suppress password logging, resulting in cleartext password disclosure in the console log and Admin panel.

Affected products

IBM Lotus Domino: 6.5.5, 6.5.6, 7.0, 7.0.2

References

http://osvdb.org/40952
http://secunia.com/advisories/27321
http://www-1.ibm.com/support/docview.wss?uid=swg21261095
http://www.securityfocus.com/bid/26176
http://www.vupen.com/english/advisories/2007/3598
https://exchange.xforce.ibmcloud.com/vulnerabilities/37372
http://osvdb.org/40952
http://secunia.com/advisories/27321
http://www-1.ibm.com/support/docview.wss?uid=swg21261095
http://www.securityfocus.com/bid/26176
http://www.vupen.com/english/advisories/2007/3598
https://exchange.xforce.ibmcloud.com/vulnerabilities/37372

Get alerted when CVE-2007-5701 or the next vulnerability affects your stack