7.1
High
CVE-2023-37534 Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters
Description
Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| HCL Leap 9.3 | earliest → < 9.3.4 | 9.3.4 |
Other CVEs of HCL Leap
The 10 CVEs of HCL Leap →
CVE-2022-44759
Improper sanitization of SVG files in HCL Leap
allows client-side script injection in deployed applications
4.6
Medium
CVE-2022-44760
Unsafe default file type filter policy in HCL
Leap allows execution of unsafe JavaScript in deployed applications
4.6
Medium
CVE-2023-37516
Missing "no cache" headers in HCL Leap permits user directory information to be cached
3.2
Low
CVE-2024-30127
Missing "no cache" headers in HCL Leap permits sensitive data to be cached
3.2
Low