CVE-2022-27563: high-severity vulnerability in HCL VersionVault Express
Overload/denial of service affects HCL VersionVault Express
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
An attacker without any credentials can overwhelm HCL VersionVault Express with requests, making the service unavailable to legitimate users. This is a denial of service attack that requires no authentication.
An unauthenticated remote attacker can trigger a denial of service condition in HCL VersionVault Express through resource exhaustion or request overload. The vulnerability allows bypassing authentication controls to send malicious input that consumes system resources, rendering the service unavailable.
In the same product, most dangerous first.