CVE-2024-23558

HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111923	Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111923	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hcltechsw:hcl_devops_deploy::::::::
	cpe:2.3:a:hcltechsw:hcl_launch::::::::
	cpe:2.3:a:hcltechsw:hcl_launch::::::::
	cpe:2.3:a:hcltechsw:hcl_launch::::::::
	cpe:2.3:a:hcltechsw:hcl_launch::::::::

History

11 Apr 2025, 18:14

Type	Values Removed	Values Added
References	~~() https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111923 -~~	() https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111923 - Vendor Advisory
First Time		Hcltechsw hcl Launch Hcltechsw Hcltechsw hcl Devops Deploy
CPE		cpe:2.3:a:hcltechsw:hcl_devops_deploy:::::::: cpe:2.3:a:hcltechsw:hcl_launch::::::::

21 Nov 2024, 08:57

Type	Values Removed	Values Added
References	~~() https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111923 -~~	() https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111923 -

01 Nov 2024, 19:35

Type	Values Removed	Values Added
CWE		CWE-290

16 Apr 2024, 13:24

Type	Values Removed	Values Added
Summary		(es) HCL DevOps Deploy/HCL Launch no invalida la sesión después del cierre de sesión, lo que podría permitir que un usuario autenticado se haga pasar por otro usuario en el sistema.

15 Apr 2024, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-04-15 21:15

Updated : 2025-04-11 18:14

NVD link : CVE-2024-23558

Mitre link : CVE-2024-23558

CVE.ORG link : CVE-2024-23558

JSON object : View

Products Affected

hcltechsw

hcl_launch
hcl_devops_deploy

CWE

CWE-290

Authentication Bypass by Spoofing

{"id": "CVE-2024-23558", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2024-04-15T21:15:07.080", "references": [{"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111923", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}, {"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111923", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.\n"}, {"lang": "es", "value": "HCL DevOps Deploy/HCL Launch no invalida la sesi\u00f3n despu\u00e9s del cierre de sesi\u00f3n, lo que podr\u00eda permitir que un usuario autenticado se haga pasar por otro usuario en el sistema."}], "lastModified": "2025-04-11T18:14:35.020", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltechsw:hcl_devops_deploy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22B5E28F-DADF-455E-A0D9-38C4FD1384CA", "versionEndExcluding": "8.0.1", "versionStartIncluding": "8.0.0.0"}, {"criteria": "cpe:2.3:a:hcltechsw:hcl_launch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4834705-7A95-4CD2-9084-6682FFF3E2E5", "versionEndExcluding": "7.0.5.21", "versionStartIncluding": "7.0.0.0"}, {"criteria": "cpe:2.3:a:hcltechsw:hcl_launch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F581AB8C-018C-424C-B421-D58AF81784D3", "versionEndExcluding": "7.1.2.17", "versionStartIncluding": "7.1.0.0"}, {"criteria": "cpe:2.3:a:hcltechsw:hcl_launch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EC6DCFF-D169-4FA3-94B9-05CCC38F4DBB", "versionEndExcluding": "7.2.3.10", "versionStartIncluding": "7.2.0.0"}, {"criteria": "cpe:2.3:a:hcltechsw:hcl_launch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5835440D-B257-42D9-B270-59768FDD8095", "versionEndExcluding": "7.3.2.5", "versionStartIncluding": "7.3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}