CVE-2023-37539 HCL Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability
An attacker with document editing rights can inject malicious scripts into the Domino Catalog template, leading to code execution or account takeover when users view the content.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-37539?
CVE-2023-37539 is a high-severity cross-site scripting vulnerability in HCL Software Domino Server, published on 6 Jun 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. An attacker with the ability to edit documents in the catalog application/database created from this template can embed a cross site scripting attack. The attack would be activated by an end user clicking it.
Weakness: CWE-79
Which versions are affected by CVE-2023-37539?
It affects 1 product.
Products include Hcltech Domino.
How do I fix CVE-2023-37539?
No fix has been published for CVE-2023-37539 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-37539 being exploited?
There is no known exploitation of CVE-2023-37539 in the wild and no public exploit code.
Other vulnerabilities in HCL Software Domino Server
- CVE-2022-44750 HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView.
- CVE-2022-44752 HCL Domino is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView
- CVE-2022-44754 HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView.
- CVE-2020-14244 Memory corruption in HCL Domino
- CVE-2020-14260 Memory corruption in HCL Domino
Sources
Also known as GHSA-pqhj-hg4g-hg2v.