CVE-2023-37503

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-521

Affected software

VendorProductVersions
HCL SoftwareHCL Compass2.0, 2.1, 2.2
hcl_softwarehcl_compass2.0; 2.1; 2.2

References

Timeline

Published
Oct 19, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-375046.5HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out funCVE-2023-375077.5HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revCVE-2023-375086.1HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if certCVE-2023-37519.8A vulnerability was found in Super Store Finder 3.6. It has been declared as critical. Affected by this vulnerability is an unknown functionCVE-2023-375114.3If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved.CVE-2023-375125.5When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitCVE-2023-375135.5When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitCVE-2023-375163.2Missing "no cache" headers in HCL Leap permits user directory information to be cached.CVE-2023-375177.5Missing "no cache" headers in HCL Leap permits sensitive data to be cached.CVE-2023-375188.8HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute wiCVE-2023-375196.1Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This XSS vulnerability is in the Download Status Report, which is served byCVE-2023-37526.1A vulnerability was found in Creativeitem Academy LMS 5.15. It has been rated as problematic. Affected by this issue is some unknown functio
CVE-2023-37503: Critical severity, CVSS 9.8 | Vulnix