Read the docs
TI-2022-18187 Aliases CVE-2022-38654GHSA-79mx-4vf7-wqf7

Information disclosure in HCL Domino

Priority LOW 24CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ignore xACL read restrictions. An authenticated attacker could leverage this vulnerability to access attributes from a user's person record.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00198 9th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HCL SoftwareHCL Domino9, 10, 11, 12—No fix listedCNA
  • HCL Domino VendorHCL Software Affected 9, 10, 11, 12 Fixed in — No fix listed CNA

CPE configurations NVD · 31

CPEVersionsRoleVendor
cpe:2.3:a:hcltech:domino:9.0.1:-:*:*:*:*:*:*9.0.1VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_3:*:*:*:*:*:*9.0.1 feature_pack_10_interim_fix_3VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_4:*:*:*:*:*:*9.0.1 feature_pack_10_interim_fix_4VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_5:*:*:*:*:*:*9.0.1 feature_pack_10_interim_fix_5VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8:*:*:*:*:*:*9.0.1 feature_pack_8VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_1:*:*:*:*:*:*9.0.1 feature_pack_8_interim_fix_1VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_2:*:*:*:*:*:*9.0.1 feature_pack_8_interim_fix_2VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_3:*:*:*:*:*:*9.0.1 feature_pack_8_interim_fix_3VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:fixpack_3:*:*:*:*:*:*9.0.1 fixpack_3VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:fixpack_4:*:*:*:*:*:*9.0.1 fixpack_4VulnerableHCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:-:*:*:*:*:*:* Versions 9.0.1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_3:*:*:*:*:*:* Versions 9.0.1 feature_pack_10_interim_fix_3 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_4:*:*:*:*:*:* Versions 9.0.1 feature_pack_10_interim_fix_4 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_5:*:*:*:*:*:* Versions 9.0.1 feature_pack_10_interim_fix_5 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8:*:*:*:*:*:* Versions 9.0.1 feature_pack_8 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_1:*:*:*:*:*:* Versions 9.0.1 feature_pack_8_interim_fix_1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_2:*:*:*:*:*:* Versions 9.0.1 feature_pack_8_interim_fix_2 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_3:*:*:*:*:*:* Versions 9.0.1 feature_pack_8_interim_fix_3 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:fixpack_3:*:*:*:*:*:* Versions 9.0.1 fixpack_3 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:fixpack_4:*:*:*:*:*:* Versions 9.0.1 fixpack_4 Vulnerable ·HCL Software
Show 21 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:hcltech:domino:9.0.1:fixpack_5:*:*:*:*:*:*9.0.1 fixpack_5VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:fixpack_6:*:*:*:*:*:*9.0.1 fixpack_6VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:fixpack_7:*:*:*:*:*:*9.0.1 fixpack_7VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:fixpack_8:*:*:*:*:*:*9.0.1 fixpack_8VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:fixpack_9:*:*:*:*:*:*9.0.1 fixpack_9VulnerableHCL Software
cpe:2.3:a:hcltech:domino:10.0.0:*:*:*:*:*:*:*10.0.0VulnerableHCL Software
cpe:2.3:a:hcltech:domino:10.0.1:-:*:*:*:*:*:*10.0.1VulnerableHCL Software
cpe:2.3:a:hcltech:domino:10.0.1:fixpack_1:*:*:*:*:*:*10.0.1 fixpack_1VulnerableHCL Software
cpe:2.3:a:hcltech:domino:10.0.1:fixpack_2:*:*:*:*:*:*10.0.1 fixpack_2VulnerableHCL Software
cpe:2.3:a:hcltech:domino:10.0.1:fixpack_3:*:*:*:*:*:*10.0.1 fixpack_3VulnerableHCL Software
cpe:2.3:a:hcltech:domino:10.0.1:fixpack_4:*:*:*:*:*:*10.0.1 fixpack_4VulnerableHCL Software
cpe:2.3:a:hcltech:domino:10.0.1:fixpack_5:*:*:*:*:*:*10.0.1 fixpack_5VulnerableHCL Software
cpe:2.3:a:hcltech:domino:10.0.1:fixpack_6:*:*:*:*:*:*10.0.1 fixpack_6VulnerableHCL Software
cpe:2.3:a:hcltech:domino:10.0.1:fixpack_7:*:*:*:*:*:*10.0.1 fixpack_7VulnerableHCL Software
cpe:2.3:a:hcltech:domino:11.0.1:-:*:*:*:*:*:*11.0.1VulnerableHCL Software
cpe:2.3:a:hcltech:domino:11.0.1:fixpack_1:*:*:*:*:*:*11.0.1 fixpack_1VulnerableHCL Software
cpe:2.3:a:hcltech:domino:11.0.1:fixpack_2:*:*:*:*:*:*11.0.1 fixpack_2VulnerableHCL Software
cpe:2.3:a:hcltech:domino:11.0.1:fixpack_3:*:*:*:*:*:*11.0.1 fixpack_3VulnerableHCL Software
cpe:2.3:a:hcltech:domino:11.0.1:fixpack_4:*:*:*:*:*:*11.0.1 fixpack_4VulnerableHCL Software
cpe:2.3:a:hcltech:domino:11.0.1:fixpack_5:*:*:*:*:*:*11.0.1 fixpack_5VulnerableHCL Software
cpe:2.3:a:hcltech:domino:12.0:*:*:*:*:*:*:*12.0VulnerableHCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:fixpack_5:*:*:*:*:*:* Versions 9.0.1 fixpack_5 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:fixpack_6:*:*:*:*:*:* Versions 9.0.1 fixpack_6 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:fixpack_7:*:*:*:*:*:* Versions 9.0.1 fixpack_7 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:fixpack_8:*:*:*:*:*:* Versions 9.0.1 fixpack_8 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:fixpack_9:*:*:*:*:*:* Versions 9.0.1 fixpack_9 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:10.0.0:*:*:*:*:*:*:* Versions 10.0.0 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:10.0.1:-:*:*:*:*:*:* Versions 10.0.1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:10.0.1:fixpack_1:*:*:*:*:*:* Versions 10.0.1 fixpack_1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:10.0.1:fixpack_2:*:*:*:*:*:* Versions 10.0.1 fixpack_2 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:10.0.1:fixpack_3:*:*:*:*:*:* Versions 10.0.1 fixpack_3 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:10.0.1:fixpack_4:*:*:*:*:*:* Versions 10.0.1 fixpack_4 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:10.0.1:fixpack_5:*:*:*:*:*:* Versions 10.0.1 fixpack_5 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:10.0.1:fixpack_6:*:*:*:*:*:* Versions 10.0.1 fixpack_6 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:10.0.1:fixpack_7:*:*:*:*:*:* Versions 10.0.1 fixpack_7 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:11.0.1:-:*:*:*:*:*:* Versions 11.0.1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:11.0.1:fixpack_1:*:*:*:*:*:* Versions 11.0.1 fixpack_1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:11.0.1:fixpack_2:*:*:*:*:*:* Versions 11.0.1 fixpack_2 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:11.0.1:fixpack_3:*:*:*:*:*:* Versions 11.0.1 fixpack_3 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:11.0.1:fixpack_4:*:*:*:*:*:* Versions 11.0.1 fixpack_4 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:11.0.1:fixpack_5:*:*:*:*:*:* Versions 11.0.1 fixpack_5 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·HCL Software

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-38654
  2. 2026-10-03 Alias added: GHSA-79mx-4vf7-wqf7

References

Advisory 1

  • TI-2022-22043 Out-of-bounds write in HCL Software Domino CVSS 3.1CRITICAL 9.8
  • TI-2022-22041 Out-of-bounds write in HCL Software Domino CVSS 3.1CRITICAL 9.8
  • TI-2022-22039 Out-of-bounds write in HCL Software Domino CVSS 3.1CRITICAL 9.8
  • TI-2020-11146 Out-of-bounds write in HCL Domino CVSS 3.1CRITICAL 9.8
  • TI-2020-11154 Buffer overflow in HCL Domino CVSS 3.1CRITICAL 9.8
  • TI-2024-15591 HCL Domino is susceptible to an information disclosure vulnerability CVSS 3.1HIGH 7.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences