CVE-2022-27546
Estado: ModificadaMedia (6.1)—
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POST request. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's web browser within the security context of the hosting web site and/or steal the victim's cookie-based authentication credentials.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Puntuación base: 6.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.64%
- Percentil entre todas las CVEs puntuadas: 49
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-79
- CWE-79
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-27546",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@hcl.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.3,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.5,
"exploitabilityScore": 2.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 6.1,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "psirt@hcl.com",
"affectedData": [
{
"vendor": "HCL Software",
"product": "HCL iNotes",
"versions": [
{
"status": "affected",
"version": "9, 10, 11, 12"
}
]
}
]
}
],
"published": "2022-08-29T16:15:08.443",
"references": [
{
"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100216",
"tags": [
"Vendor Advisory"
],
"source": "psirt@hcl.com"
},
{
"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100216",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@hcl.com",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POST request. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's web browser within the security context of the hosting web site and/or steal the victim's cookie-based authentication credentials."
},
{
"lang": "es",
"value": "HCL iNotes es susceptible de sufrir una vulnerabilidad de tipo Cross-site Scripting (XSS) Reflejado causada por una comprobación inapropiada de la entrada suministrada por el usuario con una petición de formulario POST. Un atacante remoto podría aprovechar esta vulnerabilidad usando una URL especialmente diseñada para ejecutar un script en el navegador web de la víctima dentro del contexto de seguridad del sitio web anfitrión y/o robar las credenciales de autenticación basadas en cookies de la víctima"
}
],
"lastModified": "2026-06-17T04:37:15.650",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:9.0.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "208ABCA3-9B6B-4EEB-82AB-63E51B0694C0"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:9.0.1:fixpack_10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF0007DB-2AC2-481C-AE80-520BF47182D0"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:9.0.1:fixpack_3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17D094C3-FBE2-4890-87AE-F1DB22564B53"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:9.0.1:fixpack_4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ABED4B62-2D70-4693-8195-639D9E013AAB"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:9.0.1:fixpack_5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FB3D516A-593C-42E8-A9BC-0F7FEF17CD6F"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:9.0.1:fixpack_6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3432DA33-2147-47B9-9F8E-4CD12AF73B76"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:9.0.1:fixpack_7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8436BBE-224D-4E6A-B8D1-C778749B7EA7"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:9.0.1:fixpack_8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4775916C-8806-41FD-9B82-D6D0163BB0F2"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:9.0.1:fixpack_9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A952F356-3A08-4A19-B716-03A7CD46C68E"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "028F0C13-A975-4DAE-B578-40AFA7FABEE8"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:10.0.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6DB5111E-B70F-475F-A23D-DF08FD1AB97E"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack_1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C1D927FD-BD55-4FD4-9212-C8108B69D7ED"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack_2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1D8203EA-5986-47EB-AB05-EFE068C3B34C"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack_3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BACEE95B-6B63-4734-97A9-2CAEEFA01187"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack_4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7240C49C-F627-4C24-BF8D-35D9E32CA7EA"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack_5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A030CB7F-B219-4497-8A87-46BA5A2038F1"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack_6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2CBADD58-2E61-48D0-A1B8-1C725FCD907D"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack_7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "18A495DC-905C-4421-A6FE-EF6655098DA4"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack_8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BD32C7F1-9B97-47DF-A09C-766DC5D58164"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BECB00A0-AD89-4E44-B758-45AA5C596018"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:11.0.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2433DEDD-8650-4B01-85B9-92F5D1446030"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:11.0.1:fixpack_1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "054C377C-7B4E-4825-B567-D85232EEDF09"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:11.0.1:fixpack_2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C1BFC253-23A1-42BE-A786-12D8A51862F6"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:11.0.1:fixpack_3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "85C8610A-7365-4B3C-AACD-932A9EEF3F75"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:11.0.1:fixpack_4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1BDDC0D0-D7C2-4487-AEB1-39B40DAC68CF"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:11.0.1:fixpack_5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "00BC19F7-8098-43D4-97C3-8CA1A63A94B8"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:12.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3B897EE8-EFCD-4D1C-9B83-96BDB596DF52"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:12.0.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9CD07D2A-E283-48C8-B110-95D656CF953A"
},
{
"criteria": "cpe:2.3:a:hcltech:hcl_inotes:12.0.1:fixpack_1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3AF3FF6F-3E3F-44D5-9B8F-E0784A5B376F"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:hcltech:domino:9.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F1C7C9C-2F6E-4A82-BC16-B04E53B11E20"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:9.0.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4E0BF886-B732-4210-82AA-4D2B3F77132B"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:9.0.1:fixpack_10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "866FCD8A-56FE-4D00-A9F6-F83D3400CF91"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:9.0.1:fixpack_3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9F8486D8-494D-45B0-8447-F1EDB8C2F8A5"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:9.0.1:fixpack_4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "19CC1B88-ED3D-4AD0-8B06-C75D198E1BB3"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:9.0.1:fixpack_5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C76546DF-A75A-489C-80D8-D1372F2FF586"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:9.0.1:fixpack_6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C49C0CA8-485E-4748-A5D5-C3B5FF98381E"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:9.0.1:fixpack_7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2C1D2585-833B-4A5A-AAF3-3215C52FE73A"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:9.0.1:fixpack_8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AAAE216E-780B-48A7-89D9-6FB8E799B78C"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:9.0.1:fixpack_9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A44BBF13-7FCF-4CD9-8EA7-C20CA701B8BA"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "908469B9-3B65-400D-A043-6B907B6151EE"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:10.0.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EC5EB2B8-9B48-4E9B-9726-71E4A6CCFA99"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:10.0.1:fixpack_1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D81AF106-7E8D-4B32-8F63-BD361E2E9508"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:10.0.1:fixpack_2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "67E40E37-09A5-4BBD-9602-3B72B9A3885F"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:10.0.1:fixpack_3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "656627F5-4DE4-41FE-9A6E-34D45C6B2639"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:10.0.1:fixpack_4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "37E5C137-6124-4543-83BC-12BE6BB20309"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:10.0.1:fixpack_5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F7DE084-A236-4ED8-B8A9-EBE2D0ACF580"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:10.0.1:fixpack_6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "907DF79A-A607-4F3A-9C7E-1FB028B34001"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:10.0.1:fixpack_7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9EA72598-85D1-4341-A865-1E6E278F4185"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:10.0.1:fixpack_8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0CC3C391-12CB-4DDB-B33E-A2020A738EA2"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9F7B561B-79F9-45E1-901F-B0976DD7C9AE"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:11.0.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6D792E4C-170B-4E6E-8808-EFDB3DF42417"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:11.0.1:fixpack_1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "479BE6F6-9947-4261-8685-E6357ED90CD1"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:11.0.1:fixpack_2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C63BD98F-1ADD-494D-B05A-45B86351F0D1"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:11.0.1:fixpack_3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51F750D7-3CE2-48CA-8D13-006E9CA3E383"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:11.0.1:fixpack_4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "93202EFB-89DD-49B1-9E29-77145F6A43F1"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:11.0.1:fixpack_5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B65E88C8-173C-40BE-87A3-E3512EBB7C9A"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:12.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "09FF8200-5500-420F-93DF-7F7708E76300"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:12.0.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1A3A3354-D9B3-43CA-8BB1-D9F3E73FD6F4"
},
{
"criteria": "cpe:2.3:a:hcltech:domino:12.0.1:fixpack_1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1841C21B-AA17-403F-B054-8C1FF8208173"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "psirt@hcl.com"
}