Read the docs
TI-2020-11159 Aliases CVE-2020-14271GHSA-rxm3-3v27-86hh

Cross-site scripting in HCL iNotes

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

HCL iNotes v9, v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An unauthenticated remote attacker could exploit this vulnerability using specially-crafted markup to execute script in a victim's web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.

Why it matters now

EPSS 0.0111 66th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—HCL iNotesv9, v10, v11—No fix listedCNA
  • HCL iNotes Vendor— Affected v9, v10, v11 Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:hcltech:hcl_inotes:*:*:*:*:*:*:*:*9.0 to before 10.0.1; 11.0.0 to before 11.0.1VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_inotes:10.0.1:-:*:*:*:*:*:*10.0.1VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack1:*:*:*:*:*:*10.0.1 fixpack1VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack2:*:*:*:*:*:*10.0.1 fixpack2VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack3:*:*:*:*:*:*10.0.1 fixpack3VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack4:*:*:*:*:*:*10.0.1 fixpack4VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack5:*:*:*:*:*:*10.0.1 fixpack5VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_inotes:11.0.1:-:*:*:*:*:*:*11.0.1VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_inotes:11.0.1:fixpack1:*:*:*:*:*:*11.0.1 fixpack1VulnerableHCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:*:*:*:*:*:*:*:* Versions 9.0 to before 10.0.1; 11.0.0 to before 11.0.1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:-:*:*:*:*:*:* Versions 10.0.1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack1:*:*:*:*:*:* Versions 10.0.1 fixpack1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack2:*:*:*:*:*:* Versions 10.0.1 fixpack2 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack3:*:*:*:*:*:* Versions 10.0.1 fixpack3 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack4:*:*:*:*:*:* Versions 10.0.1 fixpack4 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack5:*:*:*:*:*:* Versions 10.0.1 fixpack5 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:11.0.1:-:*:*:*:*:*:* Versions 11.0.1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_inotes:11.0.1:fixpack1:*:*:*:*:*:* Versions 11.0.1 fixpack1 Vulnerable ·HCL Software

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-14271
  2. 2026-10-03 Alias added: GHSA-rxm3-3v27-86hh

References

Advisory 1

  • TI-2022-10549 Cross-site scripting in HCL iNotes CVSS 3.1HIGH 8.3
  • TI-2022-10554 HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. CVSS 3.1HIGH 7.5
  • TI-2022-10550 Open redirect in HCL iNotes CVSS 3.1HIGH 7.4
  • TI-2020-11140 HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization… CVSS 3.1MEDIUM 6.5
  • TI-2020-03576 HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. CVSS 3.1MEDIUM 5.9
  • TI-2021-09157 HCL Notes 11.0 - 11.0.1 FP4 Sametime Embedded chat clients are vulnerable to group chats loading script on restart CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences