Skip to content
Sign in
7.1 High

CVE-2023-37504 HCL Compass is vulnerable to failure to invalidate sessions

Description

HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called.  If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.

Affected products and versions

Product Affected versions Fixed in
HCL Compass Versions not published
hcl_compass 2.2 No fix stated
hcl_compass 2.1 No fix stated
hcl_compass 2.0 No fix stated

Other CVEs of HCL Compass

The 3 CVEs of HCL Compass →
CVE-2023-37503 HCL Compass is vulnerable to insecure password requirements 8.1 High CVE-2023-37502 HCL Compass is vulnerable to lack of file upload security 9.0 Critical
Track this CVE