cnvd - cnvd-2021-03564

CNVD-2021-03564

Vulnerability from cnvd - Published: 2021-01-17

Title

HCL Commerce拒绝服务漏洞

Description

HCL Commerce是印度HCL公司的一款用于电子商务的软件平台框架。该软件在可定制的集成软件包中包括营销，销售，客户和订单处理功能。它是一个统一的平台，提供了直接与消费者，与企业，通过渠道合作伙伴间接开展业务或同时开展所有业务的能力。 HCL Commerce存在拒绝服务漏洞，该漏洞源于系统对用户输入未做正确处理，攻击者可利用该漏洞使应用拒绝服务。

Severity

高

Patch Name

HCL Commerce拒绝服务漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://support.hcltechsw.com/csm?id=kb_article&sysparm;_article=KB0086271

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-14275

Impacted products

Name
['HCL HCL Commerce >=9.1，<=9.1.4', 'HCL HCL Commerce >=9.0.0.5，<=9.0.0.13', 'HCL HCL Commerce >=9.0.1.0，<=9.0.1.14']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-14275",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-14275"
    }
  },
  "description": "HCL Commerce\u662f\u5370\u5ea6HCL\u516c\u53f8\u7684\u4e00\u6b3e\u7528\u4e8e\u7535\u5b50\u5546\u52a1\u7684\u8f6f\u4ef6\u5e73\u53f0\u6846\u67b6\u3002\u8be5\u8f6f\u4ef6\u5728\u53ef\u5b9a\u5236\u7684\u96c6\u6210\u8f6f\u4ef6\u5305\u4e2d\u5305\u62ec\u8425\u9500\uff0c\u9500\u552e\uff0c\u5ba2\u6237\u548c\u8ba2\u5355\u5904\u7406\u529f\u80fd\u3002\u5b83\u662f\u4e00\u4e2a\u7edf\u4e00\u7684\u5e73\u53f0\uff0c\u63d0\u4f9b\u4e86\u76f4\u63a5\u4e0e\u6d88\u8d39\u8005\uff0c\u4e0e\u4f01\u4e1a\uff0c\u901a\u8fc7\u6e20\u9053\u5408\u4f5c\u4f19\u4f34\u95f4\u63a5\u5f00\u5c55\u4e1a\u52a1\u6216\u540c\u65f6\u5f00\u5c55\u6240\u6709\u4e1a\u52a1\u7684\u80fd\u529b\u3002\n\nHCL Commerce\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7cfb\u7edf\u5bf9\u7528\u6237\u8f93\u5165\u672a\u505a\u6b63\u786e\u5904\u7406\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4f7f\u5e94\u7528\u62d2\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://support.hcltechsw.com/csm?id=kb_article\u0026sysparm;_article=KB0086271",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-03564",
  "openTime": "2021-01-17",
  "patchDescription": "HCL Commerce\u662f\u5370\u5ea6HCL\u516c\u53f8\u7684\u4e00\u6b3e\u7528\u4e8e\u7535\u5b50\u5546\u52a1\u7684\u8f6f\u4ef6\u5e73\u53f0\u6846\u67b6\u3002\u8be5\u8f6f\u4ef6\u5728\u53ef\u5b9a\u5236\u7684\u96c6\u6210\u8f6f\u4ef6\u5305\u4e2d\u5305\u62ec\u8425\u9500\uff0c\u9500\u552e\uff0c\u5ba2\u6237\u548c\u8ba2\u5355\u5904\u7406\u529f\u80fd\u3002\u5b83\u662f\u4e00\u4e2a\u7edf\u4e00\u7684\u5e73\u53f0\uff0c\u63d0\u4f9b\u4e86\u76f4\u63a5\u4e0e\u6d88\u8d39\u8005\uff0c\u4e0e\u4f01\u4e1a\uff0c\u901a\u8fc7\u6e20\u9053\u5408\u4f5c\u4f19\u4f34\u95f4\u63a5\u5f00\u5c55\u4e1a\u52a1\u6216\u540c\u65f6\u5f00\u5c55\u6240\u6709\u4e1a\u52a1\u7684\u80fd\u529b\u3002\r\n\r\nHCL Commerce\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7cfb\u7edf\u5bf9\u7528\u6237\u8f93\u5165\u672a\u505a\u6b63\u786e\u5904\u7406\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4f7f\u5e94\u7528\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "HCL Commerce\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "HCL HCL Commerce \u003e=9.1\uff0c\u003c=9.1.4",
      "HCL HCL Commerce \u003e=9.0.0.5\uff0c\u003c=9.0.0.13",
      "HCL HCL Commerce \u003e=9.0.1.0\uff0c\u003c=9.0.1.14"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-14275",
  "serverity": "\u9ad8",
  "submitTime": "2021-01-14",
  "title": "HCL Commerce\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2020-14275 (GCVE-0-2020-14275)

Vulnerability from cvelistv5 – Published: 2021-01-12 14:26 – Updated: 2024-08-04 12:39

Summary

Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.

Severity ?

No CVSS data available.

CWE

"Denial of Service and Information Disclosure"

Assigner

HCL

References

URL

Tags

https://support.hcltechsw.com/csm?id=kb_article&s…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	HCL Commerce	Affected: 9.0.0.5 through 9.0.0.13 Affected: 9.0.1.0 through 9.0.1.14 Affected: 9.1 through 9.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:39:36.248Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0086271"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "HCL Commerce",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.0.5 through 9.0.0.13"
            },
            {
              "status": "affected",
              "version": "9.0.1.0 through 9.0.1.14"
            },
            {
              "status": "affected",
              "version": "9.1 through 9.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "\"Denial of Service and Information Disclosure\"",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-12T14:26:58",
        "orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
        "shortName": "HCL"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0086271"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@hcl.com",
          "ID": "CVE-2020-14275",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "HCL Commerce",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "9.0.0.5 through 9.0.0.13"
                          },
                          {
                            "version_value": "9.0.1.0 through 9.0.1.14"
                          },
                          {
                            "version_value": "9.1 through 9.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "\"Denial of Service and Information Disclosure\""
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0086271",
              "refsource": "CONFIRM",
              "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0086271"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
    "assignerShortName": "HCL",
    "cveId": "CVE-2020-14275",
    "datePublished": "2021-01-12T14:26:58",
    "dateReserved": "2020-06-17T00:00:00",
    "dateUpdated": "2024-08-04T12:39:36.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-03564

CVE-2020-14275 (GCVE-0-2020-14275)

Tags

Sightings

Nomenclature