« Volver al listado

CVE-2020-14225

Estado: ModificadaMedia (6.5)—

HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization of message content. A remote unauthenticated attacker could use this vulnerability to trick the end user into entering sensitive information such as credentials, e.g. as part of a phishing attack.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Hcltech — HCL InotesHcltechsw — HCL Inotes

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-14225",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@hcl.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "HCL iNotes",
          "versions": [
            {
              "status": "affected",
              "version": "versions previous to releases 9.0.1 FP10 IF6"
            },
            {
              "status": "affected",
              "version": "10.0.1 FP5 and 11.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-12-21T18:15:14.383",
  "references": [
    {
      "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085915",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@hcl.com"
    },
    {
      "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085915",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization of message content. A remote unauthenticated attacker could use this vulnerability to trick the end user into entering sensitive information such as credentials, e.g. as part of a phishing attack."
    },
    {
      "lang": "es",
      "value": "HCL iNotes es susceptible a una vulnerabilidad de tipo Tabnabbing causada por un saneamiento inapropiado del contenido del mensaje. Un atacante no autenticado remoto podría usar esta vulnerabilidad para engañar al usuario final para que ingrese información confidencial, tales como credenciales, por ejemplo, como parte de un ataque de phishing"
    }
  ],
  "lastModified": "2026-06-17T02:54:26.177",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hcltech:hcl_inotes:10.0.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6DB5111E-B70F-475F-A23D-DF08FD1AB97E"
            },
            {
              "criteria": "cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7AA0BE4B-C5B2-4F0A-AE23-25032CC7C2E3"
            },
            {
              "criteria": "cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE8447C7-B040-461A-88AD-C407A3867928"
            },
            {
              "criteria": "cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "080E290A-A18E-45A6-9039-369763AC27CC"
            },
            {
              "criteria": "cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE08595A-7384-4DED-854F-B28C4C431FEC"
            },
            {
              "criteria": "cpe:2.3:a:hcltech:hcl_inotes:11.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63B76DD1-79D7-4320-A1E8-7B5BF5345B3E"
            },
            {
              "criteria": "cpe:2.3:a:hcltechsw:hcl_inotes:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BAF9E37-610E-4E7C-A1D9-ADA85818DBC3",
              "versionEndExcluding": "9.0.1"
            },
            {
              "criteria": "cpe:2.3:a:hcltechsw:hcl_inotes:9.0.1:fixpack_8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E43BA08A-3541-4F11-A5D4-2D2E5A775D66"
            },
            {
              "criteria": "cpe:2.3:a:hcltechsw:hcl_inotes:9.0.1:fixpack_9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD04A768-66DA-42B6-82AE-0DEDB8E9DB31"
            },
            {
              "criteria": "cpe:2.3:a:hcltechsw:hcl_inotes:9.0.1:fixpack_9_interim_fix_1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "419B397B-51F7-4C6A-A824-8082219850F6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@hcl.com"
}