Medium severity · published Oct 19, 2023
CVE-2023-37504
An insufficient session expiration vulnerability affects HCL Compass
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HC
HCL Compass · HCL Software
2.0, 2.1, 2.2 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-37504
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-37504
Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107511
More from HCL Compass
9.8
CVE-2023-37503
A weak password requirements vulnerability affects HCL Compass
8.8
CVE-2023-37502
An unrestricted file upload vulnerability affects HCL Compass