Skip to main content

Hcl Leap CVE-2022-44760

MEDIUM
Unrestricted Upload of File with Dangerous Type (CWE-434)
2025-04-24 psirt@hcl.com
File Upload Hcl Leap
4.6
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.6 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Mar 28, 2026 - 18:38 vuln.today
CVE Published
Apr 24, 2025 - 21:15 nvd
MEDIUM 4.6

DescriptionCVE.org

Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications.

AnalysisAI

Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications. Affected products include: Hcltech Hcl Leap.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

More in Hcl Leap

View all
CVE-2023-37534 HIGH
7.1 Apr 24

Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters. Rated high severity (C
CVE-2024-30147 MEDIUM
6.5 Apr 24

Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications.

CVE-2024-30113 MEDIUM
6.3 Apr 24

Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the
CVE-2023-45720 MEDIUM
5.3 Apr 24

Insufficient default configuration in HCL Leap allows anonymous access to directory information. Rated medium severity (
CVE-2022-44759 MEDIUM
4.6 Apr 24

Improper sanitization of SVG files in HCL Leap allows client-side script injection in deployed applications. Rated mediu
CVE-2024-30148 MEDIUM
4.1 Apr 24

Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's file
CVE-2024-30114 LOW
3.7 Apr 24

Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment. Rated low severi
CVE-2024-30127 LOW
3.2 Apr 24

Missing "no cache" headers in HCL Leap permits sensitive data to be cached. Rated low severity (CVSS 3.2), this vulnerab
CVE-2023-37516 LOW
3.2 Apr 24

Missing "no cache" headers in HCL Leap permits user directory information to be cached. Rated low severity (CVSS 3.2), t

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2021-31207 MEDIUM POC
6.6
CVE-2017-12617 HIGH POC
8.1
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2024-5084 CRITICAL POC
9.8
CVE-2020-36847 CRITICAL POC
9.8
CVE-2017-6090 HIGH POC
8.8

Same technique File Upload

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2017-12617 HIGH POC
8.1
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2024-5084 CRITICAL POC
9.8
CVE-2016-6600 CRITICAL POC
9.8
CVE-2017-6090 HIGH POC
8.8
CVE-2015-8249 CRITICAL POC
9.8

Share

CVE-2022-44760 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy