CVE-2023-37526

MEDIUM

HCL DRYiCE Lucy - Cross-Origin Resource Sharing Misconfiguration

Title source: llm

Description

HCL DRYiCE Lucy (now AEX) is affected by a Cross Origin Resource Sharing (CORS) vulnerability. The mobile app is vulnerable to a CORS misconfiguration which could potentially allow unauthorized access to the application resources from any web domain and enable cache poisoning attacks.

References (1)

Core 1

Core References

Various Sources

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113032

Scores

CVSS v3 6.5

EPSS 0.0043

EPSS Percentile 34.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-942

Status published

Products (1)

HCL Software/DRYiCE Lucy v9

Published May 14, 2024

Tracked Since Feb 18, 2026