medium
5.5
CWE
200
Advisory Published
Updated

CVE-2022-38654: HCL Domino is susceptible to an information disclosure vulnerability

First published: Fri Nov 04 2022(Updated: )

HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ignore xACL read restrictions. An authenticated attacker could leverage this vulnerability to access attributes from a user's person record.

Credit: psirt@hcl.com

Affected SoftwareAffected VersionHow to fix
Hcltech Domino=9.0.1
Hcltech Domino=9.0.1-feature_pack_10_interim_fix_3
Hcltech Domino=9.0.1-feature_pack_10_interim_fix_4
Hcltech Domino=9.0.1-feature_pack_10_interim_fix_5
Hcltech Domino=9.0.1-feature_pack_8
Hcltech Domino=9.0.1-feature_pack_8_interim_fix_1
Hcltech Domino=9.0.1-feature_pack_8_interim_fix_2
Hcltech Domino=9.0.1-feature_pack_8_interim_fix_3
Hcltech Domino=9.0.1-fixpack_3
Hcltech Domino=9.0.1-fixpack_4
Hcltech Domino=9.0.1-fixpack_5
Hcltech Domino=9.0.1-fixpack_6
Hcltech Domino=9.0.1-fixpack_7
Hcltech Domino=9.0.1-fixpack_8
Hcltech Domino=9.0.1-fixpack_9
Hcltech Domino=10.0.0
Hcltech Domino=10.0.1
Hcltech Domino=10.0.1-fixpack_1
Hcltech Domino=10.0.1-fixpack_2
Hcltech Domino=10.0.1-fixpack_3
Hcltech Domino=10.0.1-fixpack_4
Hcltech Domino=10.0.1-fixpack_5
Hcltech Domino=10.0.1-fixpack_6
Hcltech Domino=10.0.1-fixpack_7
Hcltech Domino=11.0.1
Hcltech Domino=11.0.1-fixpack_1
Hcltech Domino=11.0.1-fixpack_2
Hcltech Domino=11.0.1-fixpack_3
Hcltech Domino=11.0.1-fixpack_4
Hcltech Domino=11.0.1-fixpack_5
Hcltech Domino=12.0

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the vulnerability ID for this information disclosure vulnerability in HCL Domino?

    The vulnerability ID for this information disclosure vulnerability in HCL Domino is CVE-2022-38654.

  • What is the severity of CVE-2022-38654?

    The severity of CVE-2022-38654 is medium (5.5).

  • Which versions of HCL Domino are affected by CVE-2022-38654?

    The versions of HCL Domino affected by CVE-2022-38654 include 9.0.1, 9.0.1 Feature Pack 10 Interim Fix 3, 9.0.1 Feature Pack 10 Interim Fix 4, 9.0.1 Feature Pack 10 Interim Fix 5, 9.0.1 Feature Pack 8, 9.0.1 Feature Pack 8 Interim Fix 1, 9.0.1 Feature Pack 8 Interim Fix 2, 9.0.1 Feature Pack 8 Interim Fix 3, 9.0.1 Fix Pack 3, 9.0.1 Fix Pack 4, 9.0.1 Fix Pack 5, 9.0.1 Fix Pack 6, 9.0.1 Fix Pack 7, 9.0.1 Fix Pack 8, 9.0.1 Fix Pack 9, 10.0.0, 10.0.1, 10.0.1 Fix Pack 1, 10.0.1 Fix Pack 2, 10.0.1 Fix Pack 3, 10.0.1 Fix Pack 4, 10.0.1 Fix Pack 5, 10.0.1 Fix Pack 6, 10.0.1 Fix Pack 7, 11.0.1, 11.0.1 Fix Pack 1, 11.0.1 Fix Pack 2, 11.0.1 Fix Pack 3, 11.0.1 Fix Pack 4, and 11.0.1 Fix Pack 5.

  • How does this vulnerability in HCL Domino allow information disclosure?

    This vulnerability in HCL Domino allows an authenticated attacker to access attributes from a user's person record by exploiting the issue where local calls made on the server to search the Domino directory ignore xACL read restrictions.

  • Is there a fix available for CVE-2022-38654?

    Yes, to fix CVE-2022-38654, users should refer to the official support article provided by HCL Technologies for the appropriate patches or updates.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203