CVE-2023-37504

HIGH

HCL Compass 2.0.0-2.0.3 - Insufficient Session Expiration

Title source: llm

Description

HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.

References (1)

Core 1

Core References

Vendor Advisory

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107511

Scores

CVSS v3 7.1

EPSS 0.0009

EPSS Percentile 25.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-613

Status published

Products (2)

hcltech/hcl_compass 2.1.0

hcltech/hcl_compass 2.0.0 - 2.0.3

Published Oct 19, 2023

Tracked Since Feb 18, 2026