CVE-2020-4084: XSS

Published Mar 9, 2020

Updated

HCL Connections v5.5, v6.0, and v6.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Software

3 affected components

hcltech Connections=5.5

hcltech Connections=6.0

hcltech Connections=6.5

Remediation

Patch Available

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0076649

Event History

Mar 9, 2020

CVE Published

via MITRE·04:42 PM

Data Sourced

via MITRE·04:42 PM

DescriptionWeakness

Data Sourced

via NVD·05:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability identified as CVE-2020-4084?

CVE-2020-4084 is a vulnerability in HCL Connections v5.5, v6.0, and v6.5 that allows cross-site scripting (XSS) attacks.

How does CVE-2020-4084 impact HCL Connections?

CVE-2020-4084 allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.

What is the severity of CVE-2020-4084?

CVE-2020-4084 has a severity rating of medium, with a CVSS score of 5.4.

Which versions of HCL Connections are affected by CVE-2020-4084?

HCL Connections v5.5, v6.0, and v6.5 are affected by CVE-2020-4084.

How can I fix the CVE-2020-4084 vulnerability?

To fix the CVE-2020-4084 vulnerability, it is recommended to apply the latest security patches or updates provided by HCL Technologies.