Lucene search

[email protected]CVE-2020-4126

HistoryDec 01, 2020 - 12:15 a.m.

CVE-2020-4126

2020-12-0100:15:11

CWE-311

[email protected]

web.nvd.nist.gov

hcl

inotes

cve-2020-4126

vulnerability

security

cookie exposure

nvd

fix

hcl domino

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

5.7 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.9%

JSON

HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacker to capture the cookie by intercepting its transmission within an http session. Fixes are available in HCL Domino and iNotes versions 10.0.1 FP6 and 11.0.1 FP2 and later.

Affected configurations

NVD

Node

hcltechhcl_inotesRange9.0–10.0.1

hcltechhcl_inotesRange11.0.0–11.0.1

hcltechhcl_inotesMatch10.0.1-

hcltechhcl_inotesMatch10.0.1fixpack1

hcltechhcl_inotesMatch10.0.1fixpack2

hcltechhcl_inotesMatch10.0.1fixpack3

hcltechhcl_inotesMatch10.0.1fixpack4

hcltechhcl_inotesMatch10.0.1fixpack5

hcltechhcl_inotesMatch11.0.1-

hcltechhcl_inotesMatch11.0.1fixpack1

CPENameOperatorVersion
hcltech:hcl_inoteshcltech hcl inoteslt10.0.1
hcltech:hcl_inoteshcltech hcl inoteslt11.0.1

CPE	Name	Operator	Version
hcltech:hcl_inotes	hcltech hcl inotes	lt	10.0.1
hcltech:hcl_inotes	hcltech hcl inotes	lt	11.0.1

CNA Affected

[
  {
    "product": "HCL iNotes",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "v10.0.1 FP6, v11.0.1 FP2 and later"
      }
    ]
  }
]

References

support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085411

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

5.7 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.9%

JSON

Related for CVE-2020-4126

cvelist1 nvd1 prion1