CyberSec.Space Logo
Back to CVE Browser

CVE-2006-4763

HIGH
7.5
CVSS Severity Score
EPSS Score0.0460%
EPSS Percentile3.18th
PublishedSep 13, 2006
Last ModifiedApr 16, 2026

Vulnerability Description

IBM Lotus Domino Web Access (DWA) 7.0.1 does not expire a client's Lightweight Third-Party Authentication token (LtpaToken) upon logout, which allows remote attackers to obtain a user's privileges by intercepting the LtpaToken cookie.

Affected Platforms (CPE)

📦
Ibm

Lotus Domino Web Access

= 7.0.1

References & Advisories

🔗 http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049408.html
🔗 http://securityreason.com/securityalert/1571
🔗 http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21245589
🔗 http://www.fishnetsecurity.com/csirt/disclosure/ibm
🔗 http://www.securityfocus.com/archive/1/445821/100/0/threaded
🔗 http://www.securityfocus.com/bid/19966
🔗 https://exchange.xforce.ibmcloud.com/vulnerabilities/28881
🔗 http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049408.html

Related Vulnerabilities

CVE-2010-027510.0

Ultra-light Mode in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.241 for Domino 8.0.2 FP3 does not properly handle s...

CVE-2010-027410.0

Unspecified vulnerability in the Edit Contact scene in Ultra-light Mode in IBM Lotus iNotes (aka Domino Web Access or DWA) before ...

CVE-2009-459410.0

Unspecified vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.131 for Domino 8.0.x has unknown impact an...

CVE-2010-027610.0

IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.241 for Domino 8.0.2 FP3 does not properly handle navigation of the "Tr...