Medium severity · published Mar 26, 2025
CVE-2024-30155
HCL SX is susceptible to cookie with Insecure, Improper, or Missing SameSite attribute vulnerability
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values via a Cross-Site-Forgery-Request (CSRF).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HS
HCL SX · HCL Software
21 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-30155
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-30155
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120110
More from HCL SX
9.8
CVE-2024-30152
HCL SX is affected by usage of a weak cryptographic algorithm
5.7
CVE-2024-30154
HCL SX is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability