CVE-2024-30148 HCL Leap is affected by improper access control
Improper access control allows admin users to import applications from the server filesystem, potentially leading to data exposure or code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-30148?
CVE-2024-30148 is a medium-severity missing authorization vulnerability in HCL Leap, published on 24 Apr 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem.
Weakness: CWE-284
Which versions are affected by CVE-2024-30148?
It affects 1 product.
Products include Hcltech Hcl Leap.
How do I fix CVE-2024-30148?
No fix has been published for CVE-2024-30148 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-30148 being exploited?
There is no known exploitation of CVE-2024-30148 in the wild and no public exploit code.
Other vulnerabilities in HCL Leap
- CVE-2022-38657 An open redirect to malicious sites affects HCL Leap
- CVE-2023-37534 HCL Leap is affected by a Cross-site scripting (XSS) vulnerability
- CVE-2024-30147 HCL Leap is affected by a cross-site scripting (XSS) vulnerability
- CVE-2024-30113 HCL Leap is affected by a cross-site scripting (XSS) vulnerability
- CVE-2023-45720 HCL Leap is affected by a disclosure of private personal information vulnerability
Sources
Also known as GHSA-3c2j-rv98-w4xf.