« Volver al listado

CVE-2024-23558

Estado: AnalizadaMedia (6.3)—

HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Hcltechsw — HCL Devops DeployHcltechsw — HCL Launch

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-23558",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-23558",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-05T16:17:01.047150Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@hcl.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@hcl.com",
      "affectedData": [
        {
          "vendor": "HCL Software",
          "product": "DevOps Deploy / Launch",
          "versions": [
            {
              "status": "affected",
              "version": "7.0 - 7.0.5.20, 7.1 - 7.1.2.16,  7.2 - 7.2.3.9,  7.3 - 7.3.2.4, 8.0 - 8.0.0.1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:hcltechsw:hcl_launch:7.0.0.0:*:*:*:*:*:*:*"
          ],
          "vendor": "hcltechsw",
          "product": "hcl_launch",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "7.0.5.20"
            },
            {
              "status": "affected",
              "version": "7.1",
              "versionType": "custom",
              "lessThanOrEqual": "7.1.2.16"
            },
            {
              "status": "affected",
              "version": "7.2",
              "versionType": "custom",
              "lessThanOrEqual": "7.2.3.9"
            },
            {
              "status": "affected",
              "version": "7.3",
              "versionType": "custom",
              "lessThanOrEqual": "7.3.2.4"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:hcltechsw:hcl_devops_deploy:8.0.0.0:*:*:*:*:*:*:*"
          ],
          "vendor": "hcltechsw",
          "product": "hcl_devops_deploy",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "8.0.0.1"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-04-15T21:15:07.080",
  "references": [
    {
      "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111923",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@hcl.com"
    },
    {
      "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111923",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.\n"
    },
    {
      "lang": "es",
      "value": "HCL DevOps Deploy/HCL Launch no invalida la sesión después del cierre de sesión, lo que podría permitir que un usuario autenticado se haga pasar por otro usuario en el sistema."
    }
  ],
  "lastModified": "2026-06-17T07:13:09.620",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hcltechsw:hcl_devops_deploy:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22B5E28F-DADF-455E-A0D9-38C4FD1384CA",
              "versionEndExcluding": "8.0.1",
              "versionStartIncluding": "8.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:hcltechsw:hcl_launch:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4834705-7A95-4CD2-9084-6682FFF3E2E5",
              "versionEndExcluding": "7.0.5.21",
              "versionStartIncluding": "7.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:hcltechsw:hcl_launch:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F581AB8C-018C-424C-B421-D58AF81784D3",
              "versionEndExcluding": "7.1.2.17",
              "versionStartIncluding": "7.1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:hcltechsw:hcl_launch:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4EC6DCFF-D169-4FA3-94B9-05CCC38F4DBB",
              "versionEndExcluding": "7.2.3.10",
              "versionStartIncluding": "7.2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:hcltechsw:hcl_launch:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5835440D-B257-42D9-B270-59768FDD8095",
              "versionEndExcluding": "7.3.2.5",
              "versionStartIncluding": "7.3.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@hcl.com"
}