CVE-2024-30155
HCL SX is susceptible to cookie with Insecure, Improper, or Missing SameSite attribute vulnerability
- State
- Published
- Severity
- 5.5 Medium
- Published
- Mar 26, 2025
- Updated
- Mar 26, 2025
- Reserved
- Mar 22, 2024
Description
HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values via a Cross-Site-Forgery-Request (CSRF).
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.5 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | HCL |
Weaknesses
- CWE-1275 Sensitive Cookie with Improper SameSite Attribute
Affected Products
| Product | Versions |
|---|---|
HCL SXHCL Software |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.