CVE-2023-37504

HIGH

7.1

Description

HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.

CVE Details

CVSS v3.1 Score7.1

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published10/19/2023

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

hcltech:hcl_compass

Weaknesses (CWE)

CWE-613

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107511(psirt@hcl.com)

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107511(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.