Vulnerability · Published Nov 4, 2022 · Assigned by HCL
CVE-2022-38654HCL Domino is susceptible to an information disclosure vulnerability
Medium 5.5
In plain English
A medium-severity information exposure in HCL Domino from HCL Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 90.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ignore xACL read restrictions. An authenticated attacker could leverage this vulnerability to access attributes from a user's person record.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HCL Software | HCL Domino | 9, 10, 11, 12 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N