Paper/Archive/CVE-2023-37502

CVE-2023-37502

HCL Software HCL Compass — An unrestricted file upload vulnerability affects HCL Compass

CVSS 9.0 (CNA)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 47.1.471 × 209.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a user's web browser.

Affected

ProductAffectedFixed inSource

HCL Compass2.0, 2.1, 2.2–CNA

hcl_compass2.0–CISA-ADP

hcl_compass2.1–CISA-ADP

hcl_compass2.2–CISA-ADP

Scores by source

HCL (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107510