6.3

CVE-2024-23558

HCL DevOps Deploy / HCL Launch does not invalidate all session authentication cookies after logout

HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Hcltechsw ≫ Hcl Devops Deploy Version >= 8.0.0.0 < 8.0.1
Hcltechsw ≫ Hcl Launch Version >= 7.0.0.0 < 7.0.5.21
Hcltechsw ≫ Hcl Launch Version >= 7.1.0.0 < 7.1.2.17
Hcltechsw ≫ Hcl Launch Version >= 7.2.0.0 < 7.2.3.10
Hcltechsw ≫ Hcl Launch Version >= 7.3.0.0 < 7.3.2.5
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.31% 0.222
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.3 2.8 3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
psirt@hcl.com 6.3 2.8 3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE-290 Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111923
Vendor Advisory