High severity7.1NVD Advisory· Published Oct 19, 2023· Updated Jun 17, 2026
CVE-2023-37504
CVE-2023-37504
Description
HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.
Affected products
4cpe:2.3:a:hcltech:hcl_compass:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:hcltech:hcl_compass:*:*:*:*:*:*:*:*range: >=2.0.0,<=2.0.3
- cpe:2.3:a:hcltech:hcl_compass:2.1.0:*:*:*:*:*:*:*
- Range: 2.0, 2.1, 2.2
Patches
Vulnerability mechanics
References
1- support.hcltechsw.com/csmnvdVendor Advisory
News mentions
0No linked articles in our index yet.