CVE-2020-14271

Published: Dec 18, 2020Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

HCL iNotes v9, v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An unauthenticated remote attacker could exploit this vulnerability using specially-crafted markup to execute script in a victim's web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.

Affected (10)

Products: Hcltech: Hcl Inotes

Hcltech

1 product

Hcl Inotes

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Hcltech Hcl Inotes	11.0.0 ≤ version < 11.0.1
Hcltech Hcl Inotes	9.0 ≤ version < 10.0.1
Hcltech Hcl Inotes	Version 10.0.1
Hcltech Hcl Inotes	Version 10.0.1 fixpack1
Hcltech Hcl Inotes	Version 10.0.1 fixpack2
Hcltech Hcl Inotes	Version 10.0.1 fixpack3
Hcltech Hcl Inotes	Version 10.0.1 fixpack4
Hcltech Hcl Inotes	Version 10.0.1 fixpack5
Hcltech Hcl Inotes	Version 11.0.1
Hcltech Hcl Inotes	Version 11.0.1 fixpack1

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085892

Source: psirt@hcl.com

Vendor Advisory

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085892

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.