Read the docs
TI-2020-03576 Aliases CVE-2020-4126GHSA-qj8p-f375-fv39

HCL iNotes is susceptible to a sensitive cookie exposure vulnerability.

Priority LOW 28CWE-311Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-311.

Summary

HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacker to capture the cookie by intercepting its transmission within an http session. Fixes are available in HCL Domino and iNotes versions 10.0.1 FP6 and 11.0.1 FP2 and later.

Why it matters now

EPSS 0.00674 52nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—HCL iNotesv10.0.1 FP6, v11.0.1 FP2 and later—No fix listedCNA
  • HCL iNotes Vendor— Affected v10.0.1 FP6, v11.0.1 FP2 and later Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:hcltech:hcl_inotes:*:*:*:*:*:*:*:*9.0 to before 10.0.1; 11.0.0 to before 11.0.1VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_inotes:10.0.1:-:*:*:*:*:*:*10.0.1VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack1:*:*:*:*:*:*10.0.1 fixpack1VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack2:*:*:*:*:*:*10.0.1 fixpack2VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack3:*:*:*:*:*:*10.0.1 fixpack3VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack4:*:*:*:*:*:*10.0.1 fixpack4VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack5:*:*:*:*:*:*10.0.1 fixpack5VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_inotes:11.0.1:-:*:*:*:*:*:*11.0.1VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_inotes:11.0.1:fixpack1:*:*:*:*:*:*11.0.1 fixpack1VulnerableHCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:*:*:*:*:*:*:*:* Versions 9.0 to before 10.0.1; 11.0.0 to before 11.0.1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:-:*:*:*:*:*:* Versions 10.0.1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack1:*:*:*:*:*:* Versions 10.0.1 fixpack1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack2:*:*:*:*:*:* Versions 10.0.1 fixpack2 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack3:*:*:*:*:*:* Versions 10.0.1 fixpack3 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack4:*:*:*:*:*:* Versions 10.0.1 fixpack4 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack5:*:*:*:*:*:* Versions 10.0.1 fixpack5 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:11.0.1:-:*:*:*:*:*:* Versions 11.0.1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:11.0.1:fixpack1:*:*:*:*:*:* Versions 11.0.1 fixpack1 Vulnerable ·HCL Software

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-4126
  2. 2026-10-03 Alias added: GHSA-qj8p-f375-fv39

References

Advisory 1

  • TI-2022-10549 Cross-site scripting in HCL iNotes CVSS 3.1HIGH 8.3
  • TI-2022-10554 HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. CVSS 3.1HIGH 7.5
  • TI-2022-10550 Open redirect in HCL iNotes CVSS 3.1HIGH 7.4
  • TI-2020-11140 HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization… CVSS 3.1MEDIUM 6.5
  • TI-2020-11159 Cross-site scripting in HCL iNotes CVSS 3.1MEDIUM 6.1
  • TI-2021-09157 HCL Notes 11.0 - 11.0.1 FP4 Sametime Embedded chat clients are vulnerable to group chats loading script on restart CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences