Critical severity9.0NVD Advisory· Published Oct 18, 2023· Updated Jun 17, 2026

CVE-2023-37502

Description

HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a user's web browser.

Affected products

HCLTech/Hcl Compass2 versions
cpe:2.3:a:hcltech:hcl_compass:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:hcltech:hcl_compass:*:*:*:*:*:*:*:*range: >=2.0.0,<=2.0.3
- cpe:2.3:a:hcltech:hcl_compass:2.1.0:*:*:*:*:*:*:*
HCL Software/Compassllm-create
HCL Software/Hcl Compass2.0cpe-rescue
Range: 2.0, 2.1, 2.2

Patches

Vulnerability mechanics

References

support.hcltechsw.com/csmnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000