cnvd - cnvd-2021-13703

CNVD-2021-13703

Vulnerability from cnvd - Published: 2021-03-02

Title

HCL Domino访问控制错误漏洞

Description

HCL Domino是印度HCL公司的一套企业级应用程序开发平台。 HCL Domino存在访问控制错误漏洞，攻击者可利用该漏洞通过HCL Domino的XPages绕过对数据的访问限制，以获取敏感信息。

Severity

中

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://www.hcltech.com/

Reference

https://vigilance.fr/vulnerability/HCL-Domino-information-disclosure-via-XPages-34160

Impacted products

Name
['HCL HCL Domino 9', 'HCL HCL Domino 10', 'HCL HCL Domino 11']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-14270",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-14270"
    }
  },
  "description": "HCL Domino\u662f\u5370\u5ea6HCL\u516c\u53f8\u7684\u4e00\u5957\u4f01\u4e1a\u7ea7\u5e94\u7528\u7a0b\u5e8f\u5f00\u53d1\u5e73\u53f0\u3002\n\nHCL Domino\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7HCL Domino\u7684XPages\u7ed5\u8fc7\u5bf9\u6570\u636e\u7684\u8bbf\u95ee\u9650\u5236\uff0c\u4ee5\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://www.hcltech.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-13703",
  "openTime": "2021-03-02",
  "products": {
    "product": [
      "HCL HCL Domino 9",
      "HCL HCL Domino 10",
      "HCL HCL Domino 11"
    ]
  },
  "referenceLink": "https://vigilance.fr/vulnerability/HCL-Domino-information-disclosure-via-XPages-34160",
  "serverity": "\u4e2d",
  "submitTime": "2020-12-18",
  "title": "HCL Domino\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e"
}

CVE-2020-14270 (GCVE-0-2020-14270)

Vulnerability from cvelistv5 – Published: 2020-12-22 20:06 – Updated: 2024-08-04 12:39

Summary

HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input. An unauthenticated attacker could exploit this vulnerability to obtain information about the XPages software running on the Domino server.

Severity ?

No CVSS data available.

CWE

Information Disclosure

Assigner

HCL

References

URL

Tags

https://support.hcltechsw.com/csm?id=kb_article&s…

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	HCL Domino	Affected: v9, v10, v11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:39:36.259Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0085881"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "HCL Domino",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "v9, v10, v11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input. An unauthenticated attacker could exploit this vulnerability to obtain information about the XPages software running on the Domino server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure ",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-22T20:06:31",
        "orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
        "shortName": "HCL"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0085881"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@hcl.com",
          "ID": "CVE-2020-14270",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "HCL Domino",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "v9, v10, v11"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input. An unauthenticated attacker could exploit this vulnerability to obtain information about the XPages software running on the Domino server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Disclosure "
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0085881",
              "refsource": "MISC",
              "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0085881"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
    "assignerShortName": "HCL",
    "cveId": "CVE-2020-14270",
    "datePublished": "2020-12-22T20:06:31",
    "dateReserved": "2020-06-17T00:00:00",
    "dateUpdated": "2024-08-04T12:39:36.259Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-13703

CVE-2020-14270 (GCVE-0-2020-14270)

Tags

Sightings

Nomenclature