CVE-2020-14258 - Vulnerability Details - OpenCVE

Description

HCL Notes is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the client. Versions 9, 10 and 11 are affected.

Published: 2020-11-21

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

HCL

HCL Notes

affected

Version	Status	Constraints
`v9`	affected	—
`v10`	affected	—
`v11`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:hcltech:notes:9.0:::::::*
	cpe:2.3:a:hcltech:notes:10.0:::::::*
	cpe:2.3:a:hcltech:notes:11.0:::::::*

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2020-6411	HCL Notes is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the client. Versions 9, 10 and 11 are affected.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00387.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085304

History

No history.

Subscriptions

Hcltech Notes

MITRE

Status: PUBLISHED

Assigner: HCL

Published: 2020-11-21T17:24:31.000Z

Updated: 2024-08-04T12:39:36.207Z

Reserved: 2020-06-17T00:00:00.000Z

Link: CVE-2020-14258

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-11-21T18:15:11.743

Modified: 2024-11-21T05:02:55.167

Link: CVE-2020-14258

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-20

{"containers": {"cna": {"affected": [{"product": "HCL Notes", "vendor": "HCL", "versions": [{"status": "affected", "version": "v9"}, {"status": "affected", "version": "v10"}, {"status": "affected", "version": "v11"}]}], "descriptions": [{"lang": "en", "value": "HCL Notes is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the client. Versions 9, 10 and 11 are affected."}], "problemTypes": [{"descriptions": [{"description": "\"Denial of Service\"", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-11-21T17:24:31.000Z", "orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085304"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@hcl.com", "ID": "CVE-2020-14258", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "HCL Notes", "version": {"version_data": [{"version_value": "v9"}, {"version_value": "v10"}, {"version_value": "v11"}]}}]}, "vendor_name": "HCL"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "HCL Notes is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the client. Versions 9, 10 and 11 are affected."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "\"Denial of Service\""}]}]}, "references": {"reference_data": [{"name": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085304", "refsource": "CONFIRM", "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085304"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T12:39:36.207Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085304"}]}]}, "cveMetadata": {"assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "assignerShortName": "HCL", "cveId": "CVE-2020-14258", "datePublished": "2020-11-21T17:24:31.000Z", "dateReserved": "2020-06-17T00:00:00.000Z", "dateUpdated": "2024-08-04T12:39:36.207Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:notes:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "19015D39-9117-4A6E-BCD7-0951CB185399", "vulnerable": true}, {"criteria": "cpe:2.3:a:hcltech:notes:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "B3C46D23-F52D-46D7-973B-FEF916ECD181", "vulnerable": true}, {"criteria": "cpe:2.3:a:hcltech:notes:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "06AD0ACF-704C-4BBE-9059-1A1E9008D7A4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "HCL Notes is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the client. Versions 9, 10 and 11 are affected."}, {"lang": "es", "value": "HCL Notes es susceptible a una vulnerabilidad de Denegaci\u00f3n de Servicio causada por una comprobaci\u00f3n inapropiada de la entrada suministrada por el usuario. Un atacante remoto no autenticado podr\u00eda explotar esta vulnerabilidad usando un mensaje de correo electr\u00f3nico especialmente dise\u00f1ado para colgar al cliente. Las versiones 9, 10 y 11 est\u00e1n afectadas"}], "id": "CVE-2020-14258", "lastModified": "2024-11-21T05:02:55.167", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-11-21T18:15:11.743", "references": [{"source": "psirt@hcl.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085304"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085304"}], "sourceIdentifier": "psirt@hcl.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}