CVE-2023-37495

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action on the People & Groups tab in the Domino® Administrator are secured using a cryptographically weak hash algorithm. This could enable attackers with access to the hashed value to determine a user's password, e.g. using a brute force attack. This issue does not impact Person documents created through user registration https://help.hcltechsw.com/domino/10.0.1/admin/conf_userregistration_c.html .

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
HCL Software	HCL Domino Server	9, 10, 11, 12

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107585Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107585Vendor Advisory

Timeline

Published: Feb 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-374965.4HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim's web browser t CVE-2023-374978.8The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certai CVE-2023-374988.8A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an CVE-2023-374996.1A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack CVE-2023-37505.3A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race conditi CVE-2023-375006.1A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. An attacker could hijack a use CVE-2023-375016.1A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perfo CVE-2023-375028.8HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by th CVE-2023-375039.8HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts.CVE-2023-375046.5HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out fun CVE-2023-375077.5HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information rev CVE-2023-375086.1HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if cert