CVE-2023-28017
Last modified
CVE-2023-28017 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials and comprise a user's account then launch other attacks. . EPSS estimates a 0.41% chance of exploitation in the next 30 days.
Description
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials and comprise a user's account then launch other attacks.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hcltech | Connections | 6.0 |
| Hcltech | Connections | 6.5 |
| Hcltech | Connections | 7.0 |
| Hcltech | Connections | 8.0 |
References
- https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108264Patch, Vendor Advisory
- https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108264Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-28017?
How severe is CVE-2023-28017?
How do I fix CVE-2023-28017?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-28010In some configuration scenarios, the Domino server host name…5.3
- CVE-2023-28012HCL BigFix Mobile is vulnerable to a command injection attac…8.8
- CVE-2023-28013HCL Verse is susceptible to a Reflected Cross Site Scripting…6.1
- CVE-2023-28014HCL BigFix Mobile is vulnerable to a cross-site scripting at…5.4
- CVE-2023-28015The HCL Domino AppDev Pack IAM service is susceptible to a U…5.3
- CVE-2023-28016Host Header Injection vulnerability in the HCL BigFix OSD Ba…6.1
- CVE-2023-28018HCL Connections is vulnerable to a denial of service, caused…6.5
- CVE-2023-28019Insufficient validation in Bigfix WebUI API App site version…8.8
- CVE-2023-2802The Ultimate Addons for Contact Form 7 WordPress plugin befo…4.8
- CVE-2023-28020 URL redirection in Login page in HCL BigFix WebUI allows ma…6.1
- CVE-2023-28021The BigFix WebUI uses weak cipher suites. 7.5
- CVE-2023-28022HCL Connections is vulnerable to an information disclosure v…6.5
Are you affected by CVE-2023-28017?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST