What’s Vulnerable › Vulnerabilities

CVE-2023-37533: HCL Connections is vulnerable to reflected cross-site scripting

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-09 · updated 2026-06-17
• Weakness: CWE-79

Description

HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script code. This may allow the attacker to steal cookie-based authentication credentials and comprise a user's account then launch other attacks.

Affected products

• HCL Software Connections: 8.0

References

• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108434
• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108434

Get alerted when CVE-2023-37533 or the next vulnerability affects your stack