CVE-2023-37504

An insufficient session expiration vulnerability affects HCL Compass

High · published October 19, 2023

CVSS v3.1
7.1
EPSS
0%
Percentile
25.6
In the wild
Unconfirmed
What it is

HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called.  If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00335 · 25.6th percentile
Published
2023-10-19T00:09Z
EPSS history
Timeline
  • 19 OCT 00:09Z
    An insufficient session expiration vulnerability affects HCL Compass
    cvelistv5