Vulnerability · Published Aug 29, 2022 · Assigned by HCL

CVE-2022-27546HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability

High 8.3

In plain English

A high-severity cross-site scripting in HCL iNotes from HCL Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.7%top 48.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POST request. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's web browser within the security context of the hosting web site and/or steal the victim's cookie-based authentication credentials.

Affected products (as reported)

Vendor	Product	Versions
HCL Software	HCL iNotes	9, 10, 11, 12

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100216 x_refsource_MISC