CVE-2020-4081 Cross-site scripting in HCL Digital Experience

What is CVE-2020-4081?

CVE-2020-4081 is a medium-severity cross-site scripting vulnerability in HCL Digital Experience, published on 2 Feb 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS).

Weakness: CWE-79

Which versions are affected by CVE-2020-4081?

It affects 1 product.

Products include Hcltech Digital Experience.

How do I fix CVE-2020-4081?

No fix has been published for CVE-2020-4081 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2020-4081 being exploited?

There is no known exploitation of CVE-2020-4081 in the wild and no public exploit code.

Other vulnerabilities in HCL Digital Experience

• CVE-2023-37538 HCL Digital Experience is susceptible to cross site scripting (XSS) Critical 9.3
• CVE-2026-21837 HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API High 8.7
• CVE-2020-14255 HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive data to unauthorized parties via crafted requests. High 7.5
• CVE-2026-21825 HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center Medium 6.1
• CVE-2026-21826 HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-24c4-w46m-qj98.