Lucene search

[email protected]NVD:CVE-2022-38654

HistoryNov 04, 2022 - 9:15 p.m.

CVE-2022-38654

2022-11-0421:15:10

CWE-200

[email protected]

web.nvd.nist.gov

hcl domino

information disclosure

directory search

xacl read restrictions

authenticated attacker

person record access

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

12.6%

JSON

HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ignore xACL read restrictions. An authenticated attacker could leverage this vulnerability to access attributes from a user’s person record.

Affected configurations

NVD

Node

hcltechdominoMatch9.0.1-

hcltechdominoMatch9.0.1feature_pack_10_interim_fix_3

hcltechdominoMatch9.0.1feature_pack_10_interim_fix_4

hcltechdominoMatch9.0.1feature_pack_10_interim_fix_5

hcltechdominoMatch9.0.1feature_pack_8

hcltechdominoMatch9.0.1feature_pack_8_interim_fix_1

hcltechdominoMatch9.0.1feature_pack_8_interim_fix_2

hcltechdominoMatch9.0.1feature_pack_8_interim_fix_3

hcltechdominoMatch9.0.1fixpack_3

hcltechdominoMatch9.0.1fixpack_4

hcltechdominoMatch9.0.1fixpack_5

hcltechdominoMatch9.0.1fixpack_6

hcltechdominoMatch9.0.1fixpack_7

hcltechdominoMatch9.0.1fixpack_8

hcltechdominoMatch9.0.1fixpack_9

hcltechdominoMatch10.0.0

hcltechdominoMatch10.0.1-

hcltechdominoMatch10.0.1fixpack_1

hcltechdominoMatch10.0.1fixpack_2

hcltechdominoMatch10.0.1fixpack_3

hcltechdominoMatch10.0.1fixpack_4

hcltechdominoMatch10.0.1fixpack_5

hcltechdominoMatch10.0.1fixpack_6

hcltechdominoMatch10.0.1fixpack_7

hcltechdominoMatch11.0.1-

hcltechdominoMatch11.0.1fixpack_1

hcltechdominoMatch11.0.1fixpack_2

hcltechdominoMatch11.0.1fixpack_3

hcltechdominoMatch11.0.1fixpack_4

hcltechdominoMatch11.0.1fixpack_5

hcltechdominoMatch12.0

References

support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101017

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

12.6%

JSON

Related for NVD:CVE-2022-38654

cve1 prion1 cvelist1