CVE-2020-4101

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

"HCL Digital Experience is susceptible to Server Side Request Forgery."

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
n/a"HCL Digital Experience""8.5, 9.0, 9.5"

References

Timeline

Published
Jun 11, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-41026.7HCL Notes is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. A successful exploit could enabCVE-2020-41045.4HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps->Software module. An attacker can use XSS to send a maliCVE-2020-41077.8HCL Domino is affected by an Insufficient Access Control vulnerability. An authenticated attacker with local access to the system could explCVE-2020-41258.1Using HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a malicious attacker could download files from the RHEL environment by doing some CVE-2020-41265.9HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacker to capture the cooCVE-2020-41276.5HCL Domino is susceptible to a Login CSRF vulnerability. With a valid credential, an attacker could trick a user into accessing a system undCVE-2020-41285.3HCL Domino is susceptible to a lockout policy bypass vulnerability in the ID Vault service. An unauthenticated attacker could use this vulneCVE-2020-41295.3HCL Domino is susceptible to a lockout policy bypass vulnerability in the LDAP service. An unauthenticated attacker could use this vulnerabiCVE-2020-41357.5IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated user to senCVE-2020-41385.5IBM SiteProtector Appliance 3.1.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174CVE-2020-41405.4IBM Security SiteProtector System 3.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScriptCVE-2020-41465.3IBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive information, caused by missing 'HttpOnly' flag. A
CVE-2020-4101: Critical severity, CVSS 9.8 | Vulnix