CVE-2023-37504

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
HCL Software	HCL Compass	2.0, 2.1, 2.2
hcl_software	hcl_compass	2.0; 2.1; 2.2

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107511Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107511Vendor Advisory

Timeline

Published: Oct 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-375077.5HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information rev CVE-2023-375086.1HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if cert CVE-2023-37519.8A vulnerability was found in Super Store Finder 3.6. It has been declared as critical. Affected by this vulnerability is an unknown function CVE-2023-375114.3If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved.CVE-2023-375125.5When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensit CVE-2023-375135.5When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensit CVE-2023-375163.2Missing "no cache" headers in HCL Leap permits user directory information to be cached.CVE-2023-375177.5Missing "no cache" headers in HCL Leap permits sensitive data to be cached.CVE-2023-375188.8HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute wi CVE-2023-375196.1Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This XSS vulnerability is in the Download Status Report, which is served by CVE-2023-37526.1A vulnerability was found in Creativeitem Academy LMS 5.15. It has been rated as problematic. Affected by this issue is some unknown functio CVE-2023-375206.1Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data e