Lucene search

HCLCVELIST:CVE-2024-23557

HistoryApr 18, 2024 - 6:21 p.m.

CVE-2024-23557 HCL Connections is vulnerable to a user enumeration vulnerability

2024-04-1818:21:18

HCL

www.cve.org

hcl connections

user enumeration

vulnerability

cve-2024-23557

brute force attack

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

AI Score

4.4

Confidence

High

EPSS

Percentile

9.0%

JSON

HCL Connections contains a user enumeration vulnerability. Certain actions could allow an attacker to determine if the user is valid or not, leading to a possible brute force attack.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Connections",
    "vendor": "HCL Software",
    "versions": [
      {
        "status": "affected",
        "version": "7.0, 8.0"
      }
    ]
  }
]

References

support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0112488

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

AI Score

4.4

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVELIST:CVE-2024-23557