CVE-2023-28015

The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability.   During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not.  The attacker could use this information to focus a brute force attack on valid users.

• CWE-203

• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0105093Vendor Advisory
• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0105093Vendor Advisory

Published

May 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28009HCL Workload Automation is vulnerable to an XML External Ent…8.1
• CVE-2023-2801Grafana is an open-source platform for monitoring and observ…5.3
• CVE-2023-28010In some configuration scenarios, the Domino server host name…5.3
• CVE-2023-28012HCL BigFix Mobile is vulnerable to a command injection attac…8.8
• CVE-2023-28013HCL Verse is susceptible to a Reflected Cross Site Scripting…6.1
• CVE-2023-28014HCL BigFix Mobile is vulnerable to a cross-site scripting at…5.4
• CVE-2023-28016Host Header Injection vulnerability in the HCL BigFix OSD Ba…6.1
• CVE-2023-28017HCL Connections is vulnerable to a cross-site scripting atta…5.4
• CVE-2023-28018HCL Connections is vulnerable to a denial of service, caused…6.5
• CVE-2023-28019Insufficient validation in Bigfix WebUI API App site version…8.8
• CVE-2023-2802The Ultimate Addons for Contact Form 7 WordPress plugin befo…4.8
• CVE-2023-28020 URL redirection in Login page in HCL BigFix WebUI allows ma…6.1