Lucene search

[email protected]CVE-2022-38654

HistoryNov 04, 2022 - 9:15 p.m.

CVE-2022-38654

2022-11-0421:15:10

CWE-200

[email protected]

web.nvd.nist.gov

hcl domino

cve-2022-38654

information disclosure

vulnerability

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

JSON

HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ignore xACL read restrictions. An authenticated attacker could leverage this vulnerability to access attributes from a user’s person record.

Affected configurations

NVD

Node

hcltechdominoMatch9.0.1-

hcltechdominoMatch9.0.1feature_pack_10_interim_fix_3

hcltechdominoMatch9.0.1feature_pack_10_interim_fix_4

hcltechdominoMatch9.0.1feature_pack_10_interim_fix_5

hcltechdominoMatch9.0.1feature_pack_8

hcltechdominoMatch9.0.1feature_pack_8_interim_fix_1

hcltechdominoMatch9.0.1feature_pack_8_interim_fix_2

hcltechdominoMatch9.0.1feature_pack_8_interim_fix_3

hcltechdominoMatch9.0.1fixpack_3

hcltechdominoMatch9.0.1fixpack_4

hcltechdominoMatch9.0.1fixpack_5

hcltechdominoMatch9.0.1fixpack_6

hcltechdominoMatch9.0.1fixpack_7

hcltechdominoMatch9.0.1fixpack_8

hcltechdominoMatch9.0.1fixpack_9

hcltechdominoMatch10.0.0

hcltechdominoMatch10.0.1-

hcltechdominoMatch10.0.1fixpack_1

hcltechdominoMatch10.0.1fixpack_2

hcltechdominoMatch10.0.1fixpack_3

hcltechdominoMatch10.0.1fixpack_4

hcltechdominoMatch10.0.1fixpack_5

hcltechdominoMatch10.0.1fixpack_6

hcltechdominoMatch10.0.1fixpack_7

hcltechdominoMatch11.0.1-

hcltechdominoMatch11.0.1fixpack_1

hcltechdominoMatch11.0.1fixpack_2

hcltechdominoMatch11.0.1fixpack_3

hcltechdominoMatch11.0.1fixpack_4

hcltechdominoMatch11.0.1fixpack_5

hcltechdominoMatch12.0

CPENameOperatorVersion
hcltech:dominohcltech dominoeq9.0.1
hcltech:dominohcltech dominoeq10.0.0
hcltech:dominohcltech dominoeq10.0.1
hcltech:dominohcltech dominoeq11.0.1
hcltech:dominohcltech dominoeq12.0

CPE	Name	Operator	Version
hcltech:domino	hcltech domino	eq	9.0.1
hcltech:domino	hcltech domino	eq	10.0.0
hcltech:domino	hcltech domino	eq	10.0.1
hcltech:domino	hcltech domino	eq	11.0.1
hcltech:domino	hcltech domino	eq	12.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "HCL Domino",
    "vendor": "HCL Software",
    "versions": [
      {
        "status": "affected",
        "version": "9, 10, 11, 12"
      }
    ]
  }
]

References

support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101017

Social References

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

JSON

Related for CVE-2022-38654

nvd1 prion1 cvelist1