CVE-2023-37538

HCL Digital Experience is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce a victim to click on a crafted URL from some delivery mechanism (email, other web site).
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:hcltech:digital_experience:8.5:*:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.0:*:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:*:*:*:*:*:*:*

History

18 Oct 2023, 16:40

Type Values Removed Values Added
First Time Hcltech digital Experience
Hcltech
CWE CWE-79
References (MISC) https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108006 - (MISC) https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108006 - Patch, Vendor Advisory
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 6.1
CPE cpe:2.3:a:hcltech:digital_experience:9.5:*:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:8.5:*:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.0:*:*:*:*:*:*:*

11 Oct 2023, 13:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-10-11 13:15

Updated : 2024-02-28 20:33


NVD link : CVE-2023-37538

Mitre link : CVE-2023-37538

CVE.ORG link : CVE-2023-37538


JSON object : View

Products Affected

hcltech

  • digital_experience
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')