CVE-2024-30155mediumCWE-1275

CVE-2024-30155: medium-severity vulnerability in HCL SX

HCL SX is susceptible to cookie with Insecure, Improper, or Missing SameSite attribute vulnerability

Published

Follow this CVE+ Monitor HCL SX

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.5epss 0.2%
In short

HCL SX fails to properly protect its session cookies, making them vulnerable to theft through cross-site attacks. An attacker could potentially hijack a user's session if they visit a malicious website while logged in.

Technical detail

The application does not set the SameSite attribute on authorization and session cookies, enabling Cross-Site Request Forgery (CSRF) attacks. An attacker can craft malicious requests from third-party sites to trigger unauthorized actions on behalf of an authenticated user, or intercept cookie values depending on browser behavior.

Summary generated and translated by AI from the official description.
HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values via a Cross-Site-Forgery-Request (CSRF).
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
HCL Software · HCL SX
Related CVEs — HCL SX

In the same product, most dangerous first.

CVE-2024-30152MEDIUMHCL SX is affected by usage of a weak cryptographic algorithmEPSS 0.2%CVE-2024-30154MEDIUMHCL SX is susceptible to a Cross-Site Request Forgery (CSRF) vulnerabilityEPSS 0.1%