Christoph Stöttner

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: HCL Connections Docs (الإصدارات المتأثرة غير محددة) الوصف: قد لا يقوم HCL Connections Docs بالتحقق بشكل صحيح من صحة المستندات التي يتم تحميلها، مما قد يؤدي إلى حدوث حالة «رفض الخدمة» بسبب استنفاد الموارد. التوصيات: لا توجد في الوقت الحالي أي معلومات حول إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

The issue is related to a broken access control vulnerability. This vulnerability may allow an unauthorized user to update data in certain scenarios.

The issue allows an attacker to execute arbitrary script code in the browser of an unsuspecting user through a cross-site scripting attack. This can lead to the execution of malicious script code, potentially resulting in the theft of cookie-based authentication credentials and compromise of the user's account. The attacker may then launch other attacks.

HCL Connections contains a user enumeration vulnerability. Certain actions could allow an attacker to determine if a user is valid or not, leading to a possible brute force attack. This issue may allow remote attackers to exploit the vulnerability without the need for an exploit. It is recommended to check for patches from the vendor, audit logs for signs of exploit attempts, and limit access if needed.