CVE-2022-38654: HCL Domino is susceptible to an information disclosure vulnerability

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-04 · updated 2026-06-17
Weakness: CWE-200

Description

HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ignore xACL read restrictions. An authenticated attacker could leverage this vulnerability to access attributes from a user's person record.

Affected products

HCL Domino: 9.0.1, 9.0.1-feature_pack_10_interim_fix_3, 9.0.1-feature_pack_10_interim_fix_4, 9.0.1-feature_pack_10_interim_fix_5, 9.0.1-feature_pack_8, 9.0.1-feature_pack_8_interim_fix_1 (+25)

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101017
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101017

Get alerted when CVE-2022-38654 or the next vulnerability affects your stack