Security readout for executives and security teams
A flaw in the Java Virtual Machine bundled with Lotus Notes Client R5 lets a malicious website learn whether specific files exist on a visitor's computer. It does not directly steal data or run code, but it leaks information about the user's system that an attacker could use to plan follow-on attacks. This is a legacy issue in software from around 2000 and is unlikely to be relevant to modern environments. Limited to organizations still running Lotus Notes Client R5 with the embedded JVM and Java applet execution enabled. Lotus Notes R5 reached end of support long ago, so exposure in modern enterprises should be negligible. Any remaining exposure would come from legacy endpoints that browse untrusted web content while running this specific client. Very low priority for modern enterprises. Track only if Lotus Notes R5 endpoints still exist; in that case, the pressing risk is the unsupported platform itself, not this specific file-existence disclosure. Fold remediation into a broader legacy-client retirement effort rather than treating it as a standalone incident. Mitigation focus: Inventory any remaining Lotus Notes R5 clients and prioritize retiring or upgrading to a supported mail platform.; Consult IBM/HCL vendor guidance for Notes ECL hardening, since no fix is named in the cited sources.; Restrict or disable Java applet execution within legacy Notes clients where feasible..
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2000-1117 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.