HCLCVELIST:CVE-2023-37504CVE-2023-37504 An insufficient session expiration vulnerability affects HCL Compass
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
7.1 High
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.1%
HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "HCL Compass",
"vendor": "HCL Software",
"versions": [
{
"status": "affected",
"version": "2.0, 2.1, 2.2"
}
]
}
]Related
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
7.1 High
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.1%