CVE-2023-37504

6.5 mediumEPSS 0.3%

Medium (6.5) in hcltech hcl compass. EPSS 0.3% chance of exploitation in the next 30 days.

HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-31)
CWE: CWE-613
Published: 2023-10-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

hcltech:hcl_compass

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107511
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107511

Check your stack JSON