PatchTheCVECVE-2002-0407: htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathn
CVE-2002-0407 is a medium-severity flaw (CVSS 5.0) affecting domino. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathname for the server via requests that contain certain MS-DOS device names such as com5, such as (1) a request with a .pl or .java extension, or (2) a request containing a large number of periods, which causes htcgibin.exe to leak the pathname in an error message.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.0 (Medium) |
| EPSS exploit chance | 2.8% (top 14%) |
| CISA exploited list | No |
| Published | 2002-07-26 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2002-0407?
domino: upgrade to newer than 5.0.9a. Exact commands for each OS are on this page.
Is CVE-2002-0407 being exploited?
CVE-2002-0407 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2002-0407 affect?
CVE-2002-0407 affects domino. Severity is medium (CVSS 5.0). htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathname for the server via requests that contain certain MS-DOS device names such as com5, such as (1) a request with a .pl or .java e
How urgent is CVE-2002-0407?
Priority 44/100. Public exploit reference
Software pages
Related CVEs
- CVE-2000-1046 HIGH 10.0 DOWNGRADE Multiple buffer overflows in the ESMTP service of Lotus Domino 5.0.2c and earlier allow remote attackers to ca
- CVE-2024-23562 MEDIUM 5.3 DOWNGRADE A security vulnerability in HCL Domino could allow disclosure of sensitive configuration information
- CVE-2023-37539 HIGH 8.4 DOWNGRADE The Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability
- CVE-2023-37495 MEDIUM 5.9 UPGRADE Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action o
- CVE-2023-28010 MEDIUM 4.0 DOWNGRADE In some configuration scenarios, the Domino server host name can be exposed