Vulnerability · Published Mar 5, 2020 · Assigned by HCL

CVE-2020-4082

Medium 5.4

In plain English

A medium-severity security flaw in "HCL Connections" from HCL Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS NVD)5.4Medium

Exploit odds (30 days)0.7%top 48.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

Affected products (as reported)

Vendor	Product	Versions
HCL Software	"HCL Connections"	"HCL Connections 5.5"

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0075447 x_refsource_CONFIRM