CVE-2022-38654

Published: Nov 4, 2022Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ignore xACL read restrictions. An authenticated attacker could leverage this vulnerability to access attributes from a user's person record.

Affected (31)

Products: Hcltech: Domino

Hcltech

1 product

Domino

Configuration A

31 vulnerable

Vulnerable Software	Affected Versions
Hcltech Domino	Version 10.0.0
Hcltech Domino	Version 10.0.1
Hcltech Domino	Version 10.0.1 fixpack_1
Hcltech Domino	Version 10.0.1 fixpack_2
Hcltech Domino	Version 10.0.1 fixpack_3
Hcltech Domino	Version 10.0.1 fixpack_4
Hcltech Domino	Version 10.0.1 fixpack_5
Hcltech Domino	Version 10.0.1 fixpack_6
Hcltech Domino	Version 10.0.1 fixpack_7
Hcltech Domino	Version 11.0.1
Hcltech Domino	Version 11.0.1 fixpack_1
Hcltech Domino	Version 11.0.1 fixpack_2
Hcltech Domino	Version 11.0.1 fixpack_3
Hcltech Domino	Version 11.0.1 fixpack_4
Hcltech Domino	Version 11.0.1 fixpack_5
Hcltech Domino	Version 12.0
Hcltech Domino	Version 9.0.1
Hcltech Domino	Version 9.0.1 feature_pack_10_interim_fix_3
Hcltech Domino	Version 9.0.1 feature_pack_10_interim_fix_4
Hcltech Domino	Version 9.0.1 feature_pack_10_interim_fix_5
Hcltech Domino	Version 9.0.1 feature_pack_8
Hcltech Domino	Version 9.0.1 feature_pack_8_interim_fix_1
Hcltech Domino	Version 9.0.1 feature_pack_8_interim_fix_2
Hcltech Domino	Version 9.0.1 feature_pack_8_interim_fix_3
Hcltech Domino	Version 9.0.1 fixpack_3
Hcltech Domino	Version 9.0.1 fixpack_4
Hcltech Domino	Version 9.0.1 fixpack_5
Hcltech Domino	Version 9.0.1 fixpack_6
Hcltech Domino	Version 9.0.1 fixpack_7
Hcltech Domino	Version 9.0.1 fixpack_8
Hcltech Domino	Version 9.0.1 fixpack_9

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101017

Source: psirt@hcl.com

Vendor Advisory

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101017

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.