Hcl Launch
CVE-2023-45700
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.
AnalysisAI
HCL Launch is vulnerable to HTML injection. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure. Affected products include: Hcltechsw Hcl Launch.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
More in Hcl Launch
View allHCL Launch may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exh
HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on t
HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. Rated medium severity (CVSS 6.8), this vulnerability is
HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is retu
HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security
HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data
HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to imper
HCL DevOps Deploy / Launch is generating an obsolete HTTP header. Rated medium severity (CVSS 6.1), this vulnerability i
HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be
HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP
HCL DevOps Deploy / HCL Launch (UCD) could disclose sensitive user information when installing the Windows agent. Rated
An HCL UrbanCode Deploy Agent installed as a Windows service in a non-standard location could be subject to a denial of
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today