« Volver al listado

CVE-2024-42195

Estado: AnalizadaMedia (6.8)—

HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Hcltechsw — HCL Devops DeployHcltechsw — HCL Launch

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-42195",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-42195",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-05T11:05:45.576060Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@hcl.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.1,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@hcl.com",
      "affectedData": [
        {
          "vendor": "HCL Software",
          "product": "DevOps Deploy /  Launch",
          "versions": [
            {
              "status": "affected",
              "version": "7.0 - 7.0.5.24, 7.1 - 7.1.2.20, 7.2 - 7.2.3.13, 7.3 - 7.3.2.8, 8.0 - 8.0.1.3"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-12-05T05:15:06.923",
  "references": [
    {
      "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0117908",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@hcl.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@hcl.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure."
    },
    {
      "lang": "es",
      "value": "HCL DevOps Deploy / HCL Launch es vulnerable a la inyección de HTML. Esta vulnerabilidad puede permitir que un usuario incorpore etiquetas HTML arbitrarias en la interfaz de usuario web, lo que podría provocar la divulgación de información confidencial."
    }
  ],
  "lastModified": "2026-06-17T07:49:01.333",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hcltechsw:hcl_devops_deploy:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C29971D1-780D-4F4C-BD4E-BFA774CEF415",
              "versionEndExcluding": "8.0.1.4",
              "versionStartIncluding": "8.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:hcltechsw:hcl_launch:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A53C7668-7AF7-40AA-B3CF-CC40C4A443F0",
              "versionEndExcluding": "7.0.5.25",
              "versionStartIncluding": "7.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:hcltechsw:hcl_launch:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54C4744F-A34C-4755-8FCA-F420BE623811",
              "versionEndExcluding": "7.1.2.21",
              "versionStartIncluding": "7.1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:hcltechsw:hcl_launch:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C46FED1-2EAC-489D-9AFD-FAFED9D27947",
              "versionEndExcluding": "7.2.3.14",
              "versionStartIncluding": "7.2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:hcltechsw:hcl_launch:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5B6CDD4-0893-4997-BCF3-241B7DC3D467",
              "versionEndExcluding": "7.3.2.9",
              "versionStartIncluding": "7.3.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@hcl.com"
}