Read the docs
TI-2002-00234 Aliases CVE-2002-0245GHSA-529q-rv2g-9c8j

Lotus Domino server 5.0.8 with NoBanner enabled allows remote attackers to (1) determine…

Priority LOW 38Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Lotus Domino server 5.0.8 with NoBanner enabled allows remote attackers to (1) determine the physical path of the server via a request for a nonexistent file with a .pl (Perl) extension, which leaks the pathname in the error message, or (2) make any request that causes an HTTP 500 error, which leaks the server's version name in the HTTP error message.

Why it matters now

EPSS 0.02515 84th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:lotus:domino:5.0:*:*:*:*:*:*:*5.0VulnerableLotus
cpe:2.3:a:lotus:domino:5.0.1:*:*:*:*:*:*:*5.0.1VulnerableLotus
cpe:2.3:a:lotus:domino:5.0.2:*:*:*:*:*:*:*5.0.2VulnerableLotus
cpe:2.3:a:lotus:domino:5.0.3:*:*:*:*:*:*:*5.0.3VulnerableLotus
cpe:2.3:a:lotus:domino:5.0.4:*:*:*:*:*:*:*5.0.4VulnerableLotus
cpe:2.3:a:lotus:domino:5.0.4a:*:*:*:*:*:*:*5.0.4aVulnerableLotus
cpe:2.3:a:lotus:domino:5.0.5:*:*:*:*:*:*:*5.0.5VulnerableLotus
cpe:2.3:a:lotus:domino:5.0.6:*:*:*:*:*:*:*5.0.6VulnerableLotus
cpe:2.3:a:lotus:domino:5.0.6a:*:*:*:*:*:*:*5.0.6aVulnerableLotus
cpe:2.3:a:lotus:domino:5.0.7:*:*:*:*:*:*:*5.0.7VulnerableLotus
  • cpe:2.3:a:lotus:domino:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.2:*:*:*:*:*:*:* Versions 5.0.2 Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.3:*:*:*:*:*:*:* Versions 5.0.3 Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.4:*:*:*:*:*:*:* Versions 5.0.4 Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.4a:*:*:*:*:*:*:* Versions 5.0.4a Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.5:*:*:*:*:*:*:* Versions 5.0.5 Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.6:*:*:*:*:*:*:* Versions 5.0.6 Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.6a:*:*:*:*:*:*:* Versions 5.0.6a Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.7:*:*:*:*:*:*:* Versions 5.0.7 Vulnerable ·Lotus
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:lotus:domino:5.0.7a:*:*:*:*:*:*:*5.0.7aVulnerableLotus
cpe:2.3:a:lotus:domino:5.0.8:*:*:*:*:*:*:*5.0.8VulnerableLotus
cpe:2.3:a:lotus:domino:5.0.9:*:*:*:*:*:*:*5.0.9VulnerableLotus
  • cpe:2.3:a:lotus:domino:5.0.7a:*:*:*:*:*:*:* Versions 5.0.7a Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.8:*:*:*:*:*:*:* Versions 5.0.8 Vulnerable ·Lotus
  • cpe:2.3:a:lotus:domino:5.0.9:*:*:*:*:*:*:* Versions 5.0.9 Vulnerable ·Lotus

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2002-0245
  2. 2026-10-03 Alias added: GHSA-529q-rv2g-9c8j

References

Patch 1

Other 2

  • TI-2001-00809 Lotus Domino 5.x allows remote attackers to read files or execute arbitrary code by… CVSS 2.0HIGH 10.0
  • TI-2000-01036 Multiple buffer overflows in the ESMTP service of Lotus Domino 5.0.2c and earlier allow… CVSS 2.0HIGH 10.0
  • TI-2002-02104 Lotus Domino 5.0.9a and earlier, even when configured with the 'DominoNoBanner=1' option… CVSS 2.0MEDIUM 5.0
  • TI-2002-00392 htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to… CVSS 2.0MEDIUM 5.0
  • TI-2000-01191 Lotus Domino SMTP server 4.63 through 5.08 allows remote attackers to cause a denial of… CVSS 2.0MEDIUM 5.0
  • TI-2001-00973 Lotus Domino web server 5.08 allows remote attackers to determine the internal IP address… CVSS 2.0MEDIUM 5.0
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences