CVE-2019-4409 Cross-site scripting in HCL Traveler

What is CVE-2019-4409?

CVE-2019-4409 is a medium-severity cross-site scripting vulnerability in HCL Traveler, published on 18 Oct 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the entered file name. If the file name is not escaped in the returned error page, it could expose a cross-site scripting (XSS) vulnerability.

Weakness: CWE-79

Which versions are affected by CVE-2019-4409?

It affects 1 product.

Products include Hcltech Traveler.

How do I fix CVE-2019-4409?

No fix has been published for CVE-2019-4409 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2019-4409 being exploited?

There is no known exploitation of CVE-2019-4409 in the wild and no public exploit code.

Other vulnerabilities in HCL Traveler

• CVE-2022-27561 HCL Traveler is susceptible to a Reflected Cross-Site Scripting vulnerability in the web admin (LotusTraveler.nsf) High 7.5
• CVE-2021-27778 Cross-site scripting in HCL Traveler Medium 4.9
• CVE-2026-21783 HCL Traveler is affected by sensitive information disclosure Medium 4.3
• CVE-2025-0278 An internal path disclosure vulnerability affects HCL Traveler Medium 4.3
• CVE-2025-0279 HCL Traveler is affected by generation of error messages containing sensitive information Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c3cx-658g-7q5w.