Vulnerability · Published May 23, 2023 · Assigned by HCL
CVE-2023-28015HCL Domino AppDev Pack is susceptible to a User Account Enumeration vulnerability
Medium 5.3
In plain English
A medium-severity security flaw in Domino AppDev Pack from HCL Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 60.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not. The attacker could use this information to focus a brute force attack on valid users.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HCL Software | Domino AppDev Pack | < 1.0.6 |
Weakness: CWE-203 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N