CVE-2023-37504high

CVE-2023-37504: high-severity vulnerability in HCL Compass

An insufficient session expiration vulnerability affects HCL Compass

Published · Updated

Follow this CVE+ Monitor HCL Compass

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.3%
HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called.  If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Affected products
HCL Software · HCL Compass
Related CVEs — HCL Compass

In the same product, most dangerous first.

CVE-2023-37502CRITICALAn unrestricted file upload vulnerability affects HCL CompassEPSS 0.6%CVE-2023-37503HIGHA weak password requirements vulnerability affects HCL CompassEPSS 0.5%