EUVD-2026-53610
GHSA-vjj9-w76c-7q84
Severity by source
AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
Downgraded PR from H to L: log-reading access in many enterprise environments requires some privilege but not full admin; all other metrics preserved from vendor vector.
Primary rating from Vendor (hcl).
CVSS VectorVendor: hcl
Lifecycle Timeline
1DescriptionCVE.org
The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs. This only affects applications using the default login portlet.
AnalysisAI
Credential exposure in HCL Digital Experience and Digital Experience Compose allows sensitive authentication material to be written to web server logs under specific, non-default configurations when the default login portlet is in use. The flaw, classed as CWE-522 (Insufficiently Protected Credentials), means that any party with read access to web server logs - such as operations staff, log aggregation systems, or an attacker who has compromised a log pipeline - may recover cleartext or weakly protected user credentials. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Technical ContextAI
CWE-522 (Insufficiently Protected Credentials) describes a class of defect in which credentials are stored, transmitted, or logged without adequate protection - typically cleartext or with insufficient masking. In this case, HCL Digital Experience's default login portlet fails to scrub or mask credential fields before they are passed to the web server logging subsystem under specific configurations, resulting in credential material appearing in access or debug logs. HCL Digital Experience (formerly IBM WebSphere Portal) is a Java EE-based enterprise portal platform. Digital Experience Compose is its cloud-native SaaS variant. The affected component is the default login portlet, meaning only deployments relying on this built-in portlet rather than a custom or federated authentication integration are in scope.
RemediationAI
Consult HCL's security advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132659 for the vendor-confirmed fix version and patching instructions. No exact fixed version was independently confirmed from the available CVE data, so the advisory should be treated as the authoritative source before applying a patch. As a compensating control, administrators should immediately audit web server log verbosity settings and ensure credential fields (form parameters such as 'j_password' or equivalent) are excluded from access log formats - most web servers (IBM HTTP Server, Apache httpd) support request parameter masking or exclusion in their log directives. Restricting read access to web server log files and directories to only privileged operations accounts limits the window of exposure if logging of credentials does occur. Organizations not relying on the default login portlet are not affected and require no action.
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today