CVE-2023-37539: HCL Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-06 · updated 2026-06-17
Weakness: CWE-79

Description

The Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. An attacker with the ability to edit documents in the catalog application/database created from this template can embed a cross site scripting attack. The attack would be activated by an end user clicking it.

Affected products

HCL Domino: 11.0, 12.0, 14.0

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113715
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113715

Get alerted when CVE-2023-37539 or the next vulnerability affects your stack