Authenticated directory attribute disclosure via ignored xACL restrictions

Information disclosure in HCL Domino versions 9 through 12 allows local users to access attributes from Domino directory person records. Local calls made on the server to search the Domino directory ignore xACL read restrictions, allowing authenticated users to retrieve fields that the access controls should hide. The attacker must already hold authenticated access to invoke the server-side directory search; the reported consequence is disclosure of person-record attributes without stated data modification or service interruption.