PT-2020-13949 · Hcl · Hcl Notes

Published 2020-11-05 · Updated 2020-11-19 · CVE-2020-14240

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HCL Notes versions prior to 9.0.1 FP10 IF8 HCL Notes versions prior to 10.0.1 FP6 HCL Notes versions prior to 11.0.1 FP1

Description The issue is a Stored Cross-site Scripting (XSS) vulnerability. An attacker could use this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.

Recommendations For versions prior to 9.0.1 FP10 IF8, update to 9.0.1 FP10 IF8 or later. For versions prior to 10.0.1 FP6, update to 10.0.1 FP6 or later. For versions prior to 11.0.1 FP1, update to 11.0.1 FP1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-14240

Affected Products

Hcl Notes

References · 5

• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0084789 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14240 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14240 · Security Note
• https://t.me/cvenotify/5197 · Telegram Post
• https://t.me/cibsecurity/15874 · Telegram Post