Medium severity · published Oct 19, 2023
CVE-2023-37504
HCL Compass is vulnerable to failure to invalidate sessions
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HC
Hcl Compass · Hcltech
2.0.0 through 2.0.3; 2.2.0 before 2.2.3; 2.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-37504
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-37504
Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107511
More from Hcl Compass
9.8
CVE-2023-37503
HCL Compass is vulnerable to insecure password requirements
8.8
CVE-2023-37502
HCL Compass is vulnerable to lack of file upload security
8.8
CVE-2022-42447
HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS)