Vulnerability · Published Feb 20, 2024 · Assigned by HCL

CVE-2023-37495HCL Domino is susceptible to a weak cryptography vulnerability

Medium 5.9

In plain English

A medium-severity missing authentication in HCL Domino Server from HCL Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.5%top 59.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action on the People & Groups tab in the Domino® Administrator are secured using a cryptographically weak hash algorithm. This could enable attackers with access to the hashed value to determine a user's password, e.g. using a brute force attack. This issue does not impact Person documents created through user registration https://help.hcltechsw.com/domino/10.0.1/admin/conf_userregistration_c.html .

Affected products (as reported)

Vendor	Product	Versions
HCL Software	HCL Domino Server	9, 10, 11, 12

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107585