CVE-2022-42452 Cross-site scripting in HCL Launch
Attackers can inject malicious HTML into HCL Launch, enabling XSS and open redirection attacks against users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-42452?
CVE-2022-42452 is a medium-severity cross-site scripting vulnerability in HCL Launch, published on 30 Mar 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
HCL Launch is vulnerable to HTML injection. HTML code is stored and included without being sanitized. This can lead to further attacks such as XSS and Open Redirections.
Weakness: CWE-79
Which versions are affected by CVE-2022-42452?
It affects 1 product.
Products include Hcltechsw Hcl Launch.
How do I fix CVE-2022-42452?
No fix has been published for CVE-2022-42452 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-42452 being exploited?
There is no known exploitation of CVE-2022-42452 in the wild and no public exploit code.
Other vulnerabilities in HCL Launch
- CVE-2024-42196 HCL Launch is susceptible to Insertion of Sensitive Information into Log File vulnerability
- CVE-2023-45702 HCL Launch Agent as a Windows service is vulnerable to a Denial of Service
- CVE-2023-45703 HCL Launch is susceptible to a Denial of Service vulnerability
- CVE-2022-27551 HCL Launch could allow an authenticated user to obtain sensitive information (CVE-2022-27551)
- CVE-2023-23348 HCL Launch is vulnerable to sensitive information disclosure
Sources
Also known as GHSA-x3pg-369x-vc72.