Script Injection Vulnerability in HCL Leap Software
CVE-2023-37534

7.1HIGH

Key Information:

Vendor
HCL Software Software
Status
HCL Software Leap
Vendor
CVE Published:
24 April 2025

Summary

An insufficient URI protocol whitelist in HCL Leap allows for script injection via compromised query parameters. This vulnerability can lead to potential exploitation, enabling attackers to execute malicious scripts, affecting the integrity and security of web applications that utilize HCL Leap. Organizations using this software must take proactive measures to assess their exposure and mitigate risks associated with this vulnerability.

Affected Version(s)

HCL Leap < 9.3.4

References

https://support.hcl-software.com/csm?id=kb_article&syspar...

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.