CVE-2022-27551 HCL Launch could allow an authenticated user to obtain sensitive information (CVE-2022-27551)
An authenticated user can obtain sensitive information in HCL Launch due to improper security checking.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-27551?
CVE-2022-27551 is a medium-severity missing authorization vulnerability in HCL Launch, published on 3 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking.
Weakness: CWE-863
Which versions are affected by CVE-2022-27551?
It affects 1 product.
Products include Hcltechsw Hcl Launch.
How do I fix CVE-2022-27551?
No fix has been published for CVE-2022-27551 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-27551 being exploited?
There is no known exploitation of CVE-2022-27551 in the wild and no public exploit code.
Other vulnerabilities in HCL Launch
- CVE-2024-42196 HCL Launch is susceptible to Insertion of Sensitive Information into Log File vulnerability
- CVE-2023-45702 HCL Launch Agent as a Windows service is vulnerable to a Denial of Service
- CVE-2023-45703 HCL Launch is susceptible to a Denial of Service vulnerability
- CVE-2023-23348 HCL Launch is vulnerable to sensitive information disclosure
- CVE-2022-42445 HCL Launch is vulnerable to Insufficiently Protected LDAP Search Credentials (CVE-2022-42445)
Sources
Also known as GHSA-grhh-qw3f-r75r.