A recently disclosed vulnerability in HCL Software’s DevOps Deploy and Launch platforms has raised security concerns.
Identified as CVE-2024-42195, this vulnerability allows attackers to embed arbitrary HTML tags within the web user interface (UI), potentially leading to sensitive information disclosure.
The flaw, categorized as an HTML injection vulnerability, affects multiple versions of HCL Launch (7.0 through 7.3) and HCL DevOps Deploy (8.0).
The issue arises from inadequate sanitization of user inputs, enabling malicious actors to inject HTML code into the web UI. This could result in unauthorized access to sensitive data displayed on the platform.
The Common Vulnerability Scoring System (CVSS) rates this issue with a base score of 3.1, indicating a low-severity risk.
However, the HCL analysts observed that the potential for sensitive data exposure makes it critical for organizations relying on these tools to address the vulnerability promptly.
Free Webinar on Best Practices for API vulnerability & Penetration Testing: Free Registration
The following versions are confirmed to be impacted:-
HCL Launch
HCL DevOps Deploy
HCL Software has released updates to mitigate this vulnerability and strongly advises users to upgrade to the following fixed versions:-
At present, no workarounds or mitigations have been identified for this vulnerability apart from applying the recommended updates.
While the CVSS score suggests a low-severity risk, organizations should not underestimate the potential impact of HTML injection vulnerabilities, especially in environments handling sensitive operational data or user credentials.
Security teams are urged to prioritize patching affected systems and review access controls on their HCL DevOps Deploy and Launch platforms to minimize exposure.
This incident underscores the importance of regular software updates and proactive vulnerability management in safeguarding enterprise systems against emerging threats.
Analyse Real-World Malware & Phishing Attacks With ANY.RUN - Get up to 3 Free Licenses
Hackers are actively probing AI systems, turning exposed gateways and agent tools into routes for…
Hackers are making some phishing pages harder to track by changing the code delivered to…
A cyber incident reportedly forced a British power plant to halt operations for about four…
Russian hackers have used a new backdoor called HOOKEDGE to target defense manufacturers, government bodies,…
TITAN ransomware is pairing file encryption with an ambitious claim: artificial intelligence that can sort…
A fake student resume is being used to place a remote-access tool on researchers’ Windows…