CVE-2023-37504

HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107511	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hcltech:hcl_compass::::::::
	cpe:2.3:a:hcltech:hcl_compass::::::::
	cpe:2.3:a:hcltech:hcl_compass:2.1.0:::::::*

History

25 Oct 2023, 10:15

Type	Values Removed	Values Added
First Time		Hcltech hcl Compass Hcltech
CPE		cpe:2.3:a:hcltech:hcl_compass:::::::: cpe:2.3:a:hcltech:hcl_compass:2.1.0:::::::*
CWE		CWE-613
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.5
References	~~(MISC) https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107511 -~~	(MISC) https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107511 - Vendor Advisory

19 Oct 2023, 01:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-19 01:15

Updated : 2024-02-28 20:33

NVD link : CVE-2023-37504

Mitre link : CVE-2023-37504

CVE.ORG link : CVE-2023-37504

JSON object : View

Products Affected

hcltech

hcl_compass

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2023-37504", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "published": "2023-10-19T01:15:08.117", "references": [{"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107511", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. \u00a0If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.\n"}, {"lang": "es", "value": "HCL Compass es vulnerable a no invalidar las sesiones. La aplicaci\u00f3n no invalida las sesiones autenticadas cuando se llama a la funci\u00f3n de cierre de sesi\u00f3n. Si se puede descubrir el identificador de sesi\u00f3n, podr\u00eda reproducirse en la aplicaci\u00f3n y usarse para hacerse pasar por el usuario."}], "lastModified": "2023-10-25T10:15:03.807", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:hcl_compass:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "165427EA-5DFF-4A41-B983-4729032F0B61", "versionEndIncluding": "2.0.3", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:hcltech:hcl_compass:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6F50039-8D68-43FC-B45C-8FF9187A8244", "versionEndExcluding": "2.2.3", "versionStartIncluding": "2.2.0"}, {"criteria": "cpe:2.3:a:hcltech:hcl_compass:2.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC1BF706-4767-4FEB-81A5-E498DEDAC90C"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}