« Volver al listado

CVE-2022-27558

Estado: ModificadaAlta (7.5)—

HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Hcltech — DominoHcltech — HCL Inotes

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-27558",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@hcl.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@hcl.com",
      "affectedData": [
        {
          "vendor": "HCL Software",
          "product": "HCL iNotes",
          "versions": [
            {
              "status": "affected",
              "version": "12.0.1, 12.0.1FP1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-08-29T16:15:08.573",
  "references": [
    {
      "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100217",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@hcl.com"
    },
    {
      "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100217",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@hcl.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-521"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-521"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking."
    },
    {
      "lang": "es",
      "value": "HCL iNotes es susceptible de sufrir una vulnerabilidad de comprobación de solidez de la contraseña. Las políticas de contraseñas personalizadas no son aplican en determinados formularios de iNotes, lo que podría permitir a usuarios establecer contraseñas débiles, conllevando a una mayor facilidad de cracking"
    }
  ],
  "lastModified": "2026-06-17T04:37:16.210",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hcltech:domino:12.0.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A3A3354-D9B3-43CA-8BB1-D9F3E73FD6F4"
            },
            {
              "criteria": "cpe:2.3:a:hcltech:domino:12.0.1:fixpack_1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1841C21B-AA17-403F-B054-8C1FF8208173"
            },
            {
              "criteria": "cpe:2.3:a:hcltech:hcl_inotes:12.0.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9CD07D2A-E283-48C8-B110-95D656CF953A"
            },
            {
              "criteria": "cpe:2.3:a:hcltech:hcl_inotes:12.0.1:fixpack_1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AF3FF6F-3E3F-44D5-9B8F-E0784A5B376F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@hcl.com"
}