Hcltech Hcl Digital Experience vulnerabilities

4 CVEs affecting Hcltech Hcl Digital Experience, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-38662, published 2022-12-19.

More from Hcltech.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-4101, published 2020-06-11. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. "HCL Digital Experience is susceptible to Server Side Request Forgery."
• CVE-2020-14222, published 2020-11-05. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce a victim to click on a…
• CVE-2021-27774, published 2022-09-22. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. User input included in error response, which could be used in a phishing attack.
• CVE-2022-38662, published 2022-12-19. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.  In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites.