Critical severity · published Jan 12, 2021
CVE-2020-14275
Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could allow denial of service, disclosure of user personal data,…
9.8
CVSS
1.5%
EPSS
No
On KEV
Description
Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HC
Hcl Commerce · Hcltechsw
9.0.0.5 through 9.0.0.13; 9.0.1.0 through 9.0.1.14; 9.1 through 9.1.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-14275
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-14275
Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0086271
More from Hcl Commerce
9.8
CVE-2022-38656
HCL Commerce, when using Elasticsearch, can allow a remote attacker to cause a denial of service attack on the site and make administrative changes
9.1
CVE-2021-27741
" Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE) injection"
7.5
CVE-2020-14274
Information disclosure vulnerability in HCL Commerce 9.0.1.9 through 9.0.1.14 and 9.1 through 9.1.4 could allow a remote attacker to obtain user personal data via unknown vectors
7.1
CVE-2024-23576
Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations
5.0
CVE-2021-27785
HCL Commerce could allow a local attacker to obtain sensitive personal information (CVE-2021-27785)