HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability due to insufficient obfuscation of sensitive values.
Weakness
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Hcl_devops_deploy | Hcltechsw | 8.0.0.0 (including) | 8.0.1 (excluding) |
| Hcl_launch | Hcltechsw | 7.0.0.0 (including) | 7.0.5.21 (excluding) |
| Hcl_launch | Hcltechsw | 7.1.0.0 (including) | 7.1.2.17 (excluding) |
| Hcl_launch | Hcltechsw | 7.2.0.0 (including) | 7.2.3.10 (excluding) |
| Hcl_launch | Hcltechsw | 7.3.0.0 (including) | 7.3.2.5 (excluding) |
References
- https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0111926
- https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0111926