CVE-2024-30155

HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values via a Cross-Site-Forgery-Request (CSRF).

Score

CVSS 3.1 5.5 Medium

Status

Analyzed - psirt@hcl.com

Published

2025-03-26

Last modified

2025-03-26

Weaknesses

CWE-1275

Affected products

• Hcl Sx (Hcl Software)
• Hcl Sx (Hcltech)

References

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120110