CVE-2023-37533

HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script code. This may allow the attacker to steal cookie-based authentication credentials and comprise a user's account then launch other attacks.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108434	Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108434	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:connections:8.0:*:*:*:*:*:*:*

History

21 Nov 2024, 08:11

Type	Values Removed	Values Added
References	~~() https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108434 - Vendor Advisory~~	() https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108434 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~6.1~~	v2 : unknown v3 : 5.4

16 Nov 2023, 16:44

Type	Values Removed	Values Added
CWE		CWE-79
References	~~() https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108434 -~~	() https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108434 - Vendor Advisory
First Time		Hcltech connections Hcltech
CPE		cpe:2.3:a:hcltech:connections:8.0:::::::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.1

09 Nov 2023, 00:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-11-09 00:15

Updated : 2024-11-21 08:11

NVD link : CVE-2023-37533

Mitre link : CVE-2023-37533

CVE.ORG link : CVE-2023-37533

JSON object : View

Products Affected

hcltech

connections

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-37533", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2023-11-09T00:15:07.870", "references": [{"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108434", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}, {"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108434", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script code. This may allow the attacker to steal cookie-based authentication credentials and comprise a user's account then launch other attacks.\n"}, {"lang": "es", "value": "HCL Connections es vulnerable a Cross-Site Scripting (XSS) reflejado donde un atacante puede aprovechar estos problemas para ejecutar c\u00f3digo de script arbitrario en el navegador de un usuario desprevenido despu\u00e9s de visitar la URL vulnerable que contiene el c\u00f3digo de script malicioso. Esto puede permitir que el atacante robe credenciales de autenticaci\u00f3n basadas en cookies, comprenda la cuenta de un usuario y luego lance otros ataques."}], "lastModified": "2024-11-21T08:11:53.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:connections:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D55E0F2F-7C8D-4334-8B8D-CCF88431F6DF"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}