CVE-2024-23586 - OpenCVE

HCL Nomad is susceptible to an insufficient session expiration vulnerability. Under certain circumstances, an unauthenticated attacker could obtain old session information.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Hcltech	Domino Hcl Nomad Nomad Server On Domino

Configuration 1 [-]

AND

cpe:2.3:a:hcltech:hcl_nomad:*:*:*:*:*:-:*:*

cpe:2.3:a:hcltech:domino:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0115264

History

Mon, 07 Oct 2024 16:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Hcltech domino Hcltech hcl Nomad
CPEs		cpe:2.3:a:hcltech:domino:-:::::::* cpe:2.3:a:hcltech:hcl_nomad::::::-::*
Vendors & Products		Hcltech domino Hcltech hcl Nomad

Fri, 04 Oct 2024 14:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Hcltech Hcltech nomad Server On Domino
CPEs		cpe:2.3:a:hcltech:nomad_server_on_domino::::::::
Vendors & Products		Hcltech Hcltech nomad Server On Domino
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 27 Sep 2024 21:30:00 +0000

Type	Values Removed	Values Added
Description		HCL Nomad is susceptible to an insufficient session expiration vulnerability. Under certain circumstances, an unauthenticated attacker could obtain old session information.
Title		An insufficient session timeout vulnerability affects HCL Nomad server on Domino
Weaknesses		CWE-613
References		https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0115264
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: HCL

Published: 2024-09-27T21:20:29.383Z

Updated: 2024-10-04T13:56:37.356Z

Reserved: 2024-01-18T07:30:10.662Z

Link: CVE-2024-23586

Vulnrichment

Updated: 2024-10-04T13:56:32.267Z

NVD

Status : Analyzed

Published: 2024-09-27T22:15:12.930

Modified: 2024-10-07T15:30:56.227

Link: CVE-2024-23586

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-23586", "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "state": "PUBLISHED", "assignerShortName": "HCL", "dateReserved": "2024-01-18T07:30:10.662Z", "datePublished": "2024-09-27T21:20:29.383Z", "dateUpdated": "2024-10-04T13:56:37.356Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Nomad server on Domino", "vendor": "HCL Software", "versions": [{"status": "affected", "version": "<1.0.13"}]}], "datePublic": "2024-09-27T21:13:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "HCL Nomad is susceptible to an insufficient session expiration vulnerability.   Under certain circumstances, an unauthenticated attacker could obtain old session information.  "}], "value": "HCL Nomad is susceptible to an insufficient session expiration vulnerability. \u00a0 Under certain circumstances, an unauthenticated attacker could obtain old session information."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL."}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-613", "description": "CWE-613 Insufficient Session Expiration", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL", "dateUpdated": "2024-09-27T21:20:29.383Z"}, "references": [{"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0115264"}], "source": {"discovery": "UNKNOWN"}, "title": "An insufficient session timeout vulnerability affects HCL Nomad server on Domino", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "hcltech", "product": "nomad_server_on_domino", "cpes": ["cpe:2.3:a:hcltech:nomad_server_on_domino:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThan": "1.0.13", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-04T13:53:43.919681Z", "id": "CVE-2024-23586", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-04T13:56:37.356Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-23586", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-04T13:53:43.919681Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:hcltech:nomad_server_on_domino:*:*:*:*:*:*:*:*"], "vendor": "hcltech", "product": "nomad_server_on_domino", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.13", "versionType": "custom"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-04T13:56:32.267Z"}}], "cna": {"title": "An insufficient session timeout vulnerability affects HCL Nomad server on Domino", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL."}]}], "affected": [{"vendor": "HCL Software", "product": "Nomad server on Domino", "versions": [{"status": "affected", "version": "<1.0.13"}], "defaultStatus": "unaffected"}], "datePublic": "2024-09-27T21:13:00.000Z", "references": [{"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0115264"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "HCL Nomad is susceptible to an insufficient session expiration vulnerability. \u00a0 Under certain circumstances, an unauthenticated attacker could obtain old session information.", "supportingMedia": [{"type": "text/html", "value": "HCL Nomad is susceptible to an insufficient session expiration vulnerability.   Under certain circumstances, an unauthenticated attacker could obtain old session information.  ", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613 Insufficient Session Expiration"}]}], "providerMetadata": {"orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL", "dateUpdated": "2024-09-27T21:20:29.383Z"}}}, "cveMetadata": {"cveId": "CVE-2024-23586", "state": "PUBLISHED", "dateUpdated": "2024-10-04T13:56:37.356Z", "dateReserved": "2024-01-18T07:30:10.662Z", "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "datePublished": "2024-09-27T21:20:29.383Z", "assignerShortName": "HCL"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:hcl_nomad:*:*:*:*:*:-:*:*", "matchCriteriaId": "450AD83B-7471-452D-83A5-0808ECDCE637", "versionEndExcluding": "1.0.13", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:domino:-:*:*:*:*:*:*:*", "matchCriteriaId": "9381F48B-95F1-4759-A020-196184455E4E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HCL Nomad is susceptible to an insufficient session expiration vulnerability. \u00a0 Under certain circumstances, an unauthenticated attacker could obtain old session information."}, {"lang": "es", "value": "HCL Nomad es susceptible a una vulnerabilidad de expiraci\u00f3n de sesi\u00f3n insuficiente. En determinadas circunstancias, un atacante no autenticado podr\u00eda obtener informaci\u00f3n de sesiones antiguas."}], "id": "CVE-2024-23586", "lastModified": "2024-10-07T15:30:56.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@hcl.com", "type": "Secondary"}]}, "published": "2024-09-27T22:15:12.930", "references": [{"source": "psirt@hcl.com", "tags": ["Vendor Advisory"], "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0115264"}], "sourceIdentifier": "psirt@hcl.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-613"}], "source": "psirt@hcl.com", "type": "Secondary"}]}