VULNERABILITY INTELLIGENCE

CVE-2024-30155

CVSS score5.5 MEDIUM
EPSS probability0.22%
CISA KEVNot currently listed
Published2025-03-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Description

HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values via a Cross-Site-Forgery-Request (CSRF).

Weakness classification

  • psirt@hcl.com: CWE-1275

Primary references