Client-Side Script Injection in HCL Leap
CVE-2024-30113

6.3MEDIUM

Key Information:

Vendor
HCL Software Software
Status
HCL Software Leap
Vendor
CVE Published:
24 April 2025

Summary

The vulnerability exists in HCL Leap due to an insufficient sanitization policy, enabling client-side script injection within the deployed application via the HTML widget. This flaw allows attackers to execute arbitrary scripts in the context of the application's user interface, potentially leading to data theft or manipulation.

Affected Version(s)

HCL Leap < 9.3.6

References

https://support.hcl-software.com/csm?id=kb_article&syspar...

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.