CVE-2020-4082: XSS

Published Mar 5, 2020

Updated

The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

Affected Software

1 affected component

hcltech Connections=5.5

Remediation

Patch Available

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0075447

Event History

Mar 5, 2020

CVE Published

via MITRE·06:45 PM

Data Sourced

via MITRE·06:45 PM

DescriptionWeakness

Data Sourced

via NVD·07:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID for this HCL Connections issue?

The vulnerability ID for this HCL Connections issue is CVE-2020-4082.

What is the severity of CVE-2020-4082?

CVE-2020-4082 has a severity rating of medium (5.4).

How does CVE-2020-4082 affect HCL Connections?

CVE-2020-4082 affects HCL Connections version 5.5.

What is the impact of CVE-2020-4082?

CVE-2020-4082 allows a remote attacker to execute malicious scripts in a victim's web browser within the security context of the hosting web.

Is there a solution to fix CVE-2020-4082?

Yes, applying the latest security patches or updates provided by HCL Technologies is recommended to fix CVE-2020-4082.