Vulnerability Description
HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a user's web browser.
CVSS Score
9.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hcltech | Hcl Compass | >= 2.0.0, <= 2.0.3 |
Related Weaknesses (CWE)
References
- https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107510Vendor Advisory
- https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107510Vendor Advisory
FAQ
What is CVE-2023-37502?
CVE-2023-37502 is a vulnerability with a CVSS score of 9.0 (CRITICAL). HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a user's web browser.
How severe is CVE-2023-37502?
CVE-2023-37502 has been rated CRITICAL with a CVSS base score of 9.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-37502?
Check the references section above for vendor advisories and patch information. Affected products include: Hcltech Hcl Compass.