8.8

CVE-2022-38660

HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability.  An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user.  

Data is provided by the National Vulnerability Database (NVD)
Hcltech ≫ Domino Version < 9.0.1
Hcltech ≫ Domino Version9.0.1 Updatefeature_pack_10_interim_fix_3
Hcltech ≫ Domino Version9.0.1 Updatefeature_pack_10_interim_fix_4
Hcltech ≫ Domino Version9.0.1 Updatefeature_pack_10_interim_fix_5
Hcltech ≫ Domino Version9.0.1 Updatefeature_pack_8
Hcltech ≫ Domino Version9.0.1 Updatefeature_pack_8_interim_fix_1
Hcltech ≫ Domino Version9.0.1 Updatefeature_pack_8_interim_fix_2
Hcltech ≫ Domino Version9.0.1 Updatefeature_pack_8_interim_fix_3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.14% 0.343
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
psirt@hcl.com 8.3 2.8 5.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.