Lucene search

HCLCVELIST:CVE-2024-30109

HistoryJun 28, 2024 - 5:40 a.m.

CVE-2024-30109 Lack of Clickjacking Protection vulnerability affects DRYiCE AEX v10

2024-06-2805:40:32

CWE-1021

HCL

www.cve.org

cve-2024-30109

clickjacking protection

dryice aex

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

0.0004 Low

EPSS

Percentile

9.1%

JSON

HCL DRYiCE AEX is impacted by a lack of clickjacking protection in the AEX web application. An attacker can use multiple transparent or opaque layers to trick a user into clicking on a button or link on another page than the one intended.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "DRYiCE AEX",
    "vendor": "HCL Software",
    "versions": [
      {
        "status": "affected",
        "version": "10"
      }
    ]
  }
]

References

support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0114193

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for CVELIST:CVE-2024-30109