CVE-2022-38656: high-severity vulnerability in HCL Commerce
HCL Commerce, when using Elasticsearch, could be affected by a denial of service vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
HCL Commerce websites using Elasticsearch can be taken offline by attackers, who may also gain ability to make administrative changes. This is a serious flaw that affects site availability and security.
A remote attacker can trigger a denial of service condition in HCL Commerce deployments configured with Elasticsearch backend, potentially combined with unauthorized administrative access. The vulnerability requires network access to the affected service; exploitation results in service unavailability and potential privilege escalation through administrative function compromise.
In the same product, most dangerous first.