CVE-2020-4082

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
HCL Software	"HCL Connections"	"HCL Connections 5.5"

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0075447Exploit, Patch, Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0075447Exploit, Patch, Vendor Advisory

Timeline

Published: Mar 5, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-40835.5HCL Connections 6.5 is vulnerable to possible information leakage. Connections could disclose sensitive information via trace logs to a loca CVE-2020-40845.4HCL Connections v5.5, v6.0, and v6.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript c CVE-2020-40856.5"HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace to a local user."CVE-2020-40896.5HCL Notes is vulnerable to an information leakage vulnerability through its support for the 'mailto' protocol. This vulnerability could resu CVE-2020-40925.3"If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not CVE-2020-40956.0"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can CVE-2020-40976.8In HCL Notes version 9 previous to release 9.0.1 FixPack 10 Interim Fix 8, version 10 previous to release 10.0.1 FixPack 6 and version 11 pr CVE-2020-40997.5The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures CVE-2020-41004.4"HCL Verse for Android was found to employ dynamic code loading. This mechanism allows a developer to specify which components of the applic CVE-2020-41019.8"HCL Digital Experience is susceptible to Server Side Request Forgery."CVE-2020-41026.7HCL Notes is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. A successful exploit could enab CVE-2020-41045.4HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps->Software module. An attacker can use XSS to send a mali