What’s Vulnerable › Vulnerabilities

CVE-2020-4129

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-12-01 · updated 2026-06-17

Description

HCL Domino is susceptible to a lockout policy bypass vulnerability in the LDAP service. An unauthenticated attacker could use this vulnerability to mount a brute force attack against the LDAP service. Fixes are available in HCL Domino versions 9.0.1 FP10 IF6, 10.0.1 FP6 and 11.0.1 FP1 and later.

Affected products

• Hcltech Hcl Domino: before 9.0.1; from 10.0.0 before 10.0.1; from 11.0.0 before 11.0.1; 9.0.1-feature_pack_10_interim_fix_2, 9.0.1-feature_pack_10_interim_fix_3, 9.0.1-feature_pack_10_interim_fix_4, 9.0.1-feature_pack_10_interim_fix_5, 10.0.1-fixpack1, 10.0.1-fixpack2 (+3) — fixed in 10.0.1, 11.0.1, 9.0.1

How to fix

Upgrade to a fixed version: Hcltech Hcl Domino 10.0.1, 11.0.1, 9.0.1. Check the vendor advisory for mitigations.

References

• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085407
• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085407

Get alerted when CVE-2020-4129 or the next vulnerability affects your stack