Read the docs
TI-2001-00809 Aliases CVE-2001-0846GHSA-38r2-fj75-4896

Lotus Domino 5.x allows remote attackers to read files or execute arbitrary code by…

Priority HIGH 71Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Lotus Domino 5.x allows remote attackers to read files or execute arbitrary code by requesting the ReplicaID of the Web Administrator template file (webadmin.ntf).

Why it matters now

EPSS 0.41228 98th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:lotus:domino:5.0:*:*:*:*:*:*:*5.0VulnerableLotus
cpe:2.3:a:lotus:domino:5.0.1:*:*:*:*:*:*:*5.0.1VulnerableLotus
cpe:2.3:a:lotus:domino:5.0.2:*:*:*:*:*:*:*5.0.2VulnerableLotus
cpe:2.3:a:lotus:domino:5.0.2a:*:*:*:*:*:*:*5.0.2aVulnerableLotus
cpe:2.3:a:lotus:domino:5.0.2c:*:*:*:*:*:*:*5.0.2cVulnerableLotus
cpe:2.3:a:lotus:domino:5.0.3:*:*:*:*:*:*:*5.0.3VulnerableLotus
cpe:2.3:a:lotus:domino:5.0.4:*:*:*:*:*:*:*5.0.4VulnerableLotus
cpe:2.3:a:lotus:domino:5.0.4a:*:*:*:*:*:*:*5.0.4aVulnerableLotus
cpe:2.3:a:lotus:domino:5.0.5:*:*:*:*:*:*:*5.0.5VulnerableLotus
cpe:2.3:a:lotus:domino:5.0.6:*:*:*:*:*:*:*5.0.6VulnerableLotus
  • cpe:2.3:a:lotus:domino:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.2:*:*:*:*:*:*:* Versions 5.0.2 Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.2a:*:*:*:*:*:*:* Versions 5.0.2a Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.2c:*:*:*:*:*:*:* Versions 5.0.2c Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.3:*:*:*:*:*:*:* Versions 5.0.3 Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.4:*:*:*:*:*:*:* Versions 5.0.4 Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.4a:*:*:*:*:*:*:* Versions 5.0.4a Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.5:*:*:*:*:*:*:* Versions 5.0.5 Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.6:*:*:*:*:*:*:* Versions 5.0.6 Vulnerable ·Lotus
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:lotus:domino:5.0.6a:*:*:*:*:*:*:*5.0.6aVulnerableLotus
cpe:2.3:a:lotus:domino:5.0.7:*:*:*:*:*:*:*5.0.7VulnerableLotus
cpe:2.3:a:lotus:domino:5.0.7a:*:*:*:*:*:*:*5.0.7aVulnerableLotus
cpe:2.3:a:lotus:domino:5.0.8:*:*:*:*:*:*:*5.0.8VulnerableLotus
  • cpe:2.3:a:lotus:domino:5.0.6a:*:*:*:*:*:*:* Versions 5.0.6a Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.7:*:*:*:*:*:*:* Versions 5.0.7 Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.7a:*:*:*:*:*:*:* Versions 5.0.7a Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.8:*:*:*:*:*:*:* Versions 5.0.8 Vulnerable ·Lotus

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2001-0846
  2. 2026-10-03 Alias added: GHSA-38r2-fj75-4896

References

Other 3

  • TI-2000-01036 Multiple buffer overflows in the ESMTP service of Lotus Domino 5.0.2c and earlier allow… CVSS 2.0HIGH 10.0
  • TI-2002-00234 Lotus Domino server 5.0.8 with NoBanner enabled allows remote attackers to (1) determine… CVSS 2.0HIGH 7.5
  • TI-2002-02104 Lotus Domino 5.0.9a and earlier, even when configured with the 'DominoNoBanner=1' option… CVSS 2.0MEDIUM 5.0
  • TI-2002-00392 htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to… CVSS 2.0MEDIUM 5.0
  • TI-2000-01191 Lotus Domino SMTP server 4.63 through 5.08 allows remote attackers to cause a denial of… CVSS 2.0MEDIUM 5.0
  • TI-2001-00973 Lotus Domino web server 5.08 allows remote attackers to determine the internal IP address… CVSS 2.0MEDIUM 5.0
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences