{"cve":"CVE-2022-38654","nvd":{"published":"2022-11-04T21:15:10.710","modified":"2026-06-17T04:56:56.823","status":"Modified","description":"HCL Domino is susceptible to an information disclosure vulnerability.  In some scenarios, local calls made on the server to search the Domino directory will ignore xACL read restrictions.  An authenticated attacker could leverage this vulnerability to access attributes from a user's person record.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.5},"cwes":["CWE-200"],"references":["https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101017","https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101017"],"products":["hcltech:domino"],"source":"nvd","synced_at":"2026-10-19T21:37:08.729216836+00:00"},"epss":{"cve":"CVE-2022-38654","score":0.00191,"percentile":0.08849,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}