by Kastro
Paper/Archive/CVE-2023-37503

CVE-2023-37503

HCL Software HCL Compass — A weak password requirements vulnerability affects HCL Compass

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 44.7.447 × 208.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts.

Affected

ProductAffectedFixed inSource
HCL Compass2.0, 2.1, 2.2–CNA
hcl_compass2.0–CISA-ADP
hcl_compass2.1–CISA-ADP
hcl_compass2.2–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
HCL (CNA)8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsupport.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107512