CVE-2022-38660

HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101037	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hcltech:domino::::::::
	cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_3::::::
	cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_4::::::
	cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_5::::::
	cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8::::::
	cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_1::::::
	cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_2::::::
	cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_3::::::

History

07 Nov 2022, 17:18

Type	Values Removed	Values Added
References	~~(MISC) https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101037 -~~	(MISC) https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101037 - Vendor Advisory
CPE		cpe:2.3:a:hcltech:domino:::::::: cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_4:::::: cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8:::::: cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_3:::::: cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_3:::::: cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_1:::::: cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_2:::::: cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_5::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8
CWE		CWE-352

04 Nov 2022, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-11-04 20:15

Updated : 2024-02-04 22:51

NVD link : CVE-2022-38660

Mitre link : CVE-2022-38660

CVE.ORG link : CVE-2022-38660

JSON object : View

Products Affected

hcltech

domino

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2022-38660", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}]}, "published": "2022-11-04T20:15:10.363", "references": [{"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101037", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}, {"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user. \u00a0\n"}, {"lang": "es", "value": "Las aplicaciones HCL XPages son susceptibles a una vulnerabilidad de Cross-Site Request Forgery (CSRF). Un atacante no autenticado podr\u00eda aprovechar esta vulnerabilidad para realizar acciones en la aplicaci\u00f3n en nombre del usuario que inici\u00f3 sesi\u00f3n."}], "lastModified": "2023-11-07T03:50:11.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:domino:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA96995E-99EC-4260-A329-B4137AFBEB6B", "versionEndExcluding": "9.0.1"}, {"criteria": "cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D00AC8D-4E35-49F4-B0EE-C03E1EE67B8E"}, {"criteria": "cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0FBD1792-01BA-402A-859E-531F7614C9A2"}, {"criteria": "cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB652BE0-5767-4D42-A618-1315243A5C52"}, {"criteria": "cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F3D799A2-AC87-43E8-A6A2-E76E1535A7C4"}, {"criteria": "cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C9A93C4-70E8-472D-A038-14F72780E02F"}, {"criteria": "cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "442C02A0-0232-488A-8A66-62386FFBC807"}, {"criteria": "cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A349B3BD-CB3D-4290-BE9E-8FFA68C3512B"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}