CVE-2022-27546: HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability

Published Aug 29, 2022

Updated

HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POST request. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's web browser within the security context of the hosting web site and/or steal the victim's cookie-based authentication credentials.

Affected Software

59 affected components

hcltech Hcl Inotes=9.0.1

hcltech Hcl Inotes=9.0.1-fixpack_10

hcltech Hcl Inotes=9.0.1-fixpack_3

hcltech Hcl Inotes=9.0.1-fixpack_4

hcltech Hcl Inotes=9.0.1-fixpack_5

hcltech Hcl Inotes=9.0.1-fixpack_6

hcltech Hcl Inotes=9.0.1-fixpack_7

hcltech Hcl Inotes=9.0.1-fixpack_8

hcltech Hcl Inotes=9.0.1-fixpack_9

hcltech Hcl Inotes=10.0

hcltech Hcl Inotes=10.0.1

hcltech Hcl Inotes=10.0.1-fixpack_1

hcltech Hcl Inotes=10.0.1-fixpack_2

hcltech Hcl Inotes=10.0.1-fixpack_3

hcltech Hcl Inotes=10.0.1-fixpack_4

hcltech Hcl Inotes=10.0.1-fixpack_5

hcltech Hcl Inotes=10.0.1-fixpack_6

hcltech Hcl Inotes=10.0.1-fixpack_7

hcltech Hcl Inotes=10.0.1-fixpack_8

hcltech Hcl Inotes=11.0

hcltech Hcl Inotes=11.0.1

hcltech Hcl Inotes=11.0.1-fixpack_1

hcltech Hcl Inotes=11.0.1-fixpack_2

hcltech Hcl Inotes=11.0.1-fixpack_3

hcltech Hcl Inotes=11.0.1-fixpack_4

hcltech Hcl Inotes=11.0.1-fixpack_5

hcltech Hcl Inotes=12.0

hcltech Hcl Inotes=12.0.1

hcltech Hcl Inotes=12.0.1-fixpack_1

hcltech Domino=9.0

hcltech Domino=9.0.1

hcltech Domino=9.0.1-fixpack_10

hcltech Domino=9.0.1-fixpack_3

hcltech Domino=9.0.1-fixpack_4

hcltech Domino=9.0.1-fixpack_5

hcltech Domino=9.0.1-fixpack_6

hcltech Domino=9.0.1-fixpack_7

hcltech Domino=9.0.1-fixpack_8

hcltech Domino=9.0.1-fixpack_9

hcltech Domino=10.0

hcltech Domino=10.0.1

hcltech Domino=10.0.1-fixpack_1

hcltech Domino=10.0.1-fixpack_2

hcltech Domino=10.0.1-fixpack_3

hcltech Domino=10.0.1-fixpack_4

hcltech Domino=10.0.1-fixpack_5

hcltech Domino=10.0.1-fixpack_6

hcltech Domino=10.0.1-fixpack_7

hcltech Domino=10.0.1-fixpack_8

hcltech Domino=11.0

hcltech Domino=11.0.1

hcltech Domino=11.0.1-fixpack_1

hcltech Domino=11.0.1-fixpack_2

hcltech Domino=11.0.1-fixpack_3

hcltech Domino=11.0.1-fixpack_4

hcltech Domino=11.0.1-fixpack_5

hcltech Domino=12.0

hcltech Domino=12.0.1

hcltech Domino=12.0.1-fixpack_1

Event History

Aug 29, 2022

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-27546?

CVE-2022-27546 is classified as a medium severity vulnerability.

How do I fix CVE-2022-27546?

To fix CVE-2022-27546, users should update to the latest version of HCL iNotes or apply the relevant patches as provided by HCL.

What types of attacks can exploit CVE-2022-27546?

CVE-2022-27546 can be exploited through reflected Cross-site Scripting (XSS) attacks via specially-crafted URLs.

Which software versions are affected by CVE-2022-27546?

CVE-2022-27546 affects HCL iNotes versions 9.0.1 and all fixpacks, as well as major versions 10.0, 11.0, and 12.0.

Can CVE-2022-27546 affect users' data?

Yes, CVE-2022-27546 can potentially compromise user data by executing malicious scripts in the context of the user's session.

CVE-2022-27546: HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2022-27546?

How do I fix CVE-2022-27546?

What types of attacks can exploit CVE-2022-27546?

Which software versions are affected by CVE-2022-27546?

Can CVE-2022-27546 affect users' data?

Company

Resources

Contact