CVE-2005-2428: Lotus Domino WebMail hidden form fields expose password hash and client data

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated network access to password hashes with a public exploit and very high EPSS makes this a serious exposure despite the medium CVSS v2 score.

What it is

Lotus Domino R5 and R6 WebMail, when "Generate HTML for all fields" is enabled, embeds sensitive names.nsf data in hidden form fields. Because the fields are hidden rather than removed, anyone who can view the page source can read the values. This exposes the HTTP password hash and related account and client details.

Impact

An unauthenticated remote attacker can obtain the HTTPPassword hash plus password change date, client platform, machine name and Domino release. The password hash can be cracked offline or reused where the same credential is valid, and the client details aid further targeting.

Attack surface

Reachable over the network via the WebMail interface (CVSS vector AV:N/AC:L/Au:N), with no authentication and no user interaction required. The attacker only needs to request the page and inspect the returned HTML source.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is very high at 0.73028 (99.4th percentile) and a public Exploit-DB entry (39495) exists, indicating mature public exploitation.

What to do

• Apply the IBM vendor fix referenced in IBM support document swg21212934, or upgrade off the affected Domino R5/R6 WebMail releases.
• Disable the "Generate HTML for all fields" option in WebMail so sensitive names.nsf fields are not rendered into the page.
• Remove or mask HTTPPassword, HTTPPasswordChangeDate, ClntPltfrm, ClntMachine and ClntBld from any form output.
• Restrict network access to the Domino WebMail interface to trusted networks or place it behind authentication and a reverse proxy.
• Rotate HTTP passwords for accounts whose hashes may have been exposed.

Detection

• Search HTTP response bodies for hidden input fields named HTTPPassword, HTTPPasswordChangeDate, ClntPltfrm, ClntMachine or ClntBld.
• Alert on requests to WebMail pages that return these field names in the HTML source, especially from unexpected source addresses.
• Review Domino WebMail configuration to confirm whether "Generate HTML for all fields" is enabled.
• Monitor for repeated page-source retrieval patterns consistent with automated scraping of WebMail forms.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.