CVE-2022-38660

HCL XPages applications are susceptible to Cross Site Request Forgery (CSRF) vulnerability

State: Published
Severity: 8.3 High
Published: Nov 4, 2022
Updated: May 2, 2025
Reserved: Aug 22, 2022

Description

HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user.

Scores

CVSS	Score	Vector	Source
3.1	8.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L	HCL

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
HCL DominoHCL Software	v9Affected

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101037

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.