CVE-2023-37535: HCL Domino Volt and Domino Leap are affected by a Cross-site scripting (XSS) vulnerability
Published Apr 30, 2025
·Updated
Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters.
Affected Software
3 affected components
HCL Domino Volt
HCL Domino Leap
hcltech Domino Leap>=1.1<1.1.3
Event History
Apr 30, 2025
CVE Published
via MITRE·09:12 PM
Data Sourced
via MITRE·09:12 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-37535?
CVE-2023-37535 has been assigned a medium severity level due to its potential for script injection.
2
How do I fix CVE-2023-37535?
To fix CVE-2023-37535, ensure that your HCL Domino Volt and Domino Leap installations implement proper URI protocol whitelisting.
3
What software is affected by CVE-2023-37535?
CVE-2023-37535 affects HCL Domino Volt and HCL Domino Leap.
4
What type of vulnerability is CVE-2023-37535?
CVE-2023-37535 is a vulnerability involving insufficient URI protocol whitelisting, allowing for script injection.
5
Are there any workarounds for CVE-2023-37535?
Currently, disabling problematic query parameter input may serve as a temporary workaround for CVE-2023-37535.