PT-2023-21483 · Hcl · Hcl Connections

Published 2023-12-06 · Updated 2023-12-12 · CVE-2023-28017

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HCL Connections (affected versions not specified)

Description The issue allows an attacker to execute arbitrary script code in the browser of an unsuspecting user after visiting a vulnerable URL, leading to the execution of malicious script code. This may enable the attacker to steal cookie-based authentication credentials and compromise a user's account, then launch other attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-28017

Affected Products

Hcl Connections

References · 6

• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108264 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28017 · Security Note
• https://twitter.com/RedPacketSec/status/1733066601694433387 · Twitter Post
• https://twitter.com/CVEnew/status/1732620804372742566 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1732650747257377128 · Twitter Post