CVE-2020-4126 Information disclosure in HCL iNotes
An unauthenticated remote attacker can capture sensitive cookies via HTTP interception, potentially leading to account takeover in HCL iNotes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-4126?
CVE-2020-4126 is a medium-severity vulnerability in HCL iNotes, published on 30 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacker to capture the cookie by intercepting its transmission within an http session. Fixes are available in HCL Domino and iNotes versions 10.0.1 FP6 and 11.0.1 FP2 and later.
Weakness: CWE-311
Which versions are affected by CVE-2020-4126?
It affects 1 product.
Products include Hcltech Hcl Inotes.
How do I fix CVE-2020-4126?
No fix has been published for CVE-2020-4126 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-4126 being exploited?
There is no known exploitation of CVE-2020-4126 in the wild and no public exploit code.
Other vulnerabilities in HCL iNotes
Sources
Also known as GHSA-qj8p-f375-fv39.