peter bassill · operator
$ cve CVE-2008-1965 JSON

CVE-2008-1965 EXPLOIT

9.3
HIGH · CVSS 2.0 · EPSS 10.7% (pctl 96)

Patch early

A public exploit exists.

Description

Argument injection vulnerability in the cai: URI handler in rcplauncher in IBM Lotus Expeditor Client for Desktop 6.1.1 and 6.1.2, as used by Lotus Symphony and possibly other products, allows remote attackers to execute arbitrary code by injecting a -launcher option via a cai: URI, as demonstrated by a reference to a UNC share pathname.

Scoring

CVSS9.3 (HIGH, v2.0)
VectorAV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS10.68% — more likely to be exploited than 96% of all CVEs
WeaknessCWE-94
On CISA KEVno
Public exploityes
Published2008-04-25
Last modified2026-06-16

Affected (2)

VendorProduct
ibmlotus expeditor client
ibmlotus symphany

Public exploits

SourceTitleDate
exploit-dbIBM Lotus Expeditor 6.1 - URI Handler Command Execution2008-04-24

References

→ the Explorer  ·  watch your stack  ·  NVD