CVE-2022-38654: HCL Domino is susceptible to an information disclosure vulnerability
HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ignore xACL read restrictions. An authenticated attacker could leverage this vulnerability to access attributes from a user's person record.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this information disclosure vulnerability in HCL Domino?
The vulnerability ID for this information disclosure vulnerability in HCL Domino is CVE-2022-38654.
What is the severity of CVE-2022-38654?
The severity of CVE-2022-38654 is medium (5.5).
Which versions of HCL Domino are affected by CVE-2022-38654?
The versions of HCL Domino affected by CVE-2022-38654 include 9.0.1, 9.0.1 Feature Pack 10 Interim Fix 3, 9.0.1 Feature Pack 10 Interim Fix 4, 9.0.1 Feature Pack 10 Interim Fix 5, 9.0.1 Feature Pack 8, 9.0.1 Feature Pack 8 Interim Fix 1, 9.0.1 Feature Pack 8 Interim Fix 2, 9.0.1 Feature Pack 8 Interim Fix 3, 9.0.1 Fix Pack 3, 9.0.1 Fix Pack 4, 9.0.1 Fix Pack 5, 9.0.1 Fix Pack 6, 9.0.1 Fix Pack 7, 9.0.1 Fix Pack 8, 9.0.1 Fix Pack 9, 10.0.0, 10.0.1, 10.0.1 Fix Pack 1, 10.0.1 Fix Pack 2, 10.0.1 Fix Pack 3, 10.0.1 Fix Pack 4, 10.0.1 Fix Pack 5, 10.0.1 Fix Pack 6, 10.0.1 Fix Pack 7, 11.0.1, 11.0.1 Fix Pack 1, 11.0.1 Fix Pack 2, 11.0.1 Fix Pack 3, 11.0.1 Fix Pack 4, and 11.0.1 Fix Pack 5.
How does this vulnerability in HCL Domino allow information disclosure?
This vulnerability in HCL Domino allows an authenticated attacker to access attributes from a user's person record by exploiting the issue where local calls made on the server to search the Domino directory ignore xACL read restrictions.
Is there a fix available for CVE-2022-38654?
Yes, to fix CVE-2022-38654, users should refer to the official support article provided by HCL Technologies for the appropriate patches or updates.