HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information when a single piece of internal metadata is returned in the browser.
Weakness
The product’s intended functionality exposes information to certain actors in accordance with the developer’s security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product’s administrator, users, or others whose information is being processed.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Connections | Hcltech | 7.0 (including) | 7.0 (including) |
| Connections | Hcltech | 8.0 (including) | 8.0 (including) |
| Connections | Hcltech | 8.0-cumulative_release1 (including) | 8.0-cumulative_release1 (including) |
| Connections | Hcltech | 8.0-cumulative_release10 (including) | 8.0-cumulative_release10 (including) |
| Connections | Hcltech | 8.0-cumulative_release2 (including) | 8.0-cumulative_release2 (including) |
| Connections | Hcltech | 8.0-cumulative_release3 (including) | 8.0-cumulative_release3 (including) |
| Connections | Hcltech | 8.0-cumulative_release4 (including) | 8.0-cumulative_release4 (including) |
| Connections | Hcltech | 8.0-cumulative_release5 (including) | 8.0-cumulative_release5 (including) |
| Connections | Hcltech | 8.0-cumulative_release6 (including) | 8.0-cumulative_release6 (including) |
| Connections | Hcltech | 8.0-cumulative_release7 (including) | 8.0-cumulative_release7 (including) |
| Connections | Hcltech | 8.0-cumulative_release8 (including) | 8.0-cumulative_release8 (including) |
| Connections | Hcltech | 8.0-cumulative_release9 (including) | 8.0-cumulative_release9 (including) |
Extended Description
When handling information, the developer must consider whether the information is regarded as sensitive by different stakeholders, such as users or administrators. Each stakeholder effectively has its own intended security policy that the product is expected to uphold. When a developer does not treat that information as sensitive, this can introduce a vulnerability that violates the expectations of the product’s users.
References
- https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0124242