Skip to main content

Unica CVE-2023-37498

HIGH
2023-08-03 psirt@hcl.com
Privilege Escalation Unica Hcltech
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Aug 03, 2023 - 22:15 nvd
HIGH 8.8

DescriptionNVD

A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator.  It is possible that an attacker could potentially escalate their privileges.

AnalysisAI

A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could potentially escalate their privileges. Affected products include: Hcltech Unica.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Unica

View all
CVE-2025-62319 CRITICAL
9.8 Mar 16

A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend datab
CVE-2023-37497 HIGH
8.8 Aug 03

The Unica application exposes an API which accepts arbitrary XML input. Rated high severity (CVSS 8.8), this vulnerabili
CVE-2026-22514 HIGH
8.1 Mar 25

This is a Local File Inclusion (LFI) vulnerability in AncoraThemes Unica WordPress theme versions up to and including 1.
CVE-2025-51735 HIGH
7.5 Nov 28

CSV formula injection vulnerability in HCL Technologies Ltd. Rated high severity (CVSS 7.5), this vulnerability is remot
CVE-2025-51736 MEDIUM
6.3 Nov 28

File upload vulnerability in HCL Technologies Ltd. Rated medium severity (CVSS 6.3), this vulnerability is remotely expl
CVE-2023-37501 MEDIUM
6.1 Aug 03

A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. Rated medium severity (CVSS 6.1)
CVE-2023-37500 MEDIUM
6.1 Aug 03

A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. Rated mediu
CVE-2023-37499 MEDIUM
6.1 Aug 03

A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. Rated
CVE-2025-51733 MEDIUM
5.5 Nov 28

Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Rated medium severity (CVSS 5.5), this vulnerab
CVE-2025-51734 MEDIUM
5.4 Nov 28

Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Rated medium severity (CVSS 5.4), this vulnerability i

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

CVE-2023-37498 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy