HCL Domino is susceptible to a weak cryptography vulnerability

CVE-2023-37495

Summary

A security issue has been identified in the HCL Domino® Directory, where internet passwords stored in Person documents are protected using a cryptographically weak hash algorithm. This vulnerability affects documents created through the 'Add Person' action within the People & Groups tab of the Domino® Administrator. Attackers with access to the hashed values may exploit this flaw, potentially revealing user passwords through methods such as brute force attacks. It is important to note that Person documents generated via user registration processes are not affected by this vulnerability.

References