Read the docs
TI-2022-18193 Aliases CVE-2022-38660GHSA-pm8g-g665-8r7q

HCL XPages applications are susceptible to Cross Site Request Forgery (CSRF) vulnerability

Priority LOW 38CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0034 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HCL SoftwareHCL Dominov9—No fix listedCNA
  • HCL Domino VendorHCL Software Affected v9 Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:hcltech:domino:*:*:*:*:*:*:*:*before 9.0.1VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_3:*:*:*:*:*:*9.0.1 feature_pack_10_interim_fix_3VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_4:*:*:*:*:*:*9.0.1 feature_pack_10_interim_fix_4VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_5:*:*:*:*:*:*9.0.1 feature_pack_10_interim_fix_5VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8:*:*:*:*:*:*9.0.1 feature_pack_8VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_1:*:*:*:*:*:*9.0.1 feature_pack_8_interim_fix_1VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_2:*:*:*:*:*:*9.0.1 feature_pack_8_interim_fix_2VulnerableHCL Software
cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_3:*:*:*:*:*:*9.0.1 feature_pack_8_interim_fix_3VulnerableHCL Software
  • cpe:2.3:a:hcltech:domino:*:*:*:*:*:*:*:* Versions before 9.0.1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_3:*:*:*:*:*:* Versions 9.0.1 feature_pack_10_interim_fix_3 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_4:*:*:*:*:*:* Versions 9.0.1 feature_pack_10_interim_fix_4 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_10_interim_fix_5:*:*:*:*:*:* Versions 9.0.1 feature_pack_10_interim_fix_5 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8:*:*:*:*:*:* Versions 9.0.1 feature_pack_8 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_1:*:*:*:*:*:* Versions 9.0.1 feature_pack_8_interim_fix_1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_2:*:*:*:*:*:* Versions 9.0.1 feature_pack_8_interim_fix_2 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:domino:9.0.1:feature_pack_8_interim_fix_3:*:*:*:*:*:* Versions 9.0.1 feature_pack_8_interim_fix_3 Vulnerable ·HCL Software

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-38660
  2. 2026-10-03 Alias added: GHSA-pm8g-g665-8r7q

References

Advisory 1

  • TI-2022-22043 Out-of-bounds write in HCL Software Domino CVSS 3.1CRITICAL 9.8
  • TI-2022-22041 Out-of-bounds write in HCL Software Domino CVSS 3.1CRITICAL 9.8
  • TI-2022-22039 Out-of-bounds write in HCL Software Domino CVSS 3.1CRITICAL 9.8
  • TI-2020-11146 Out-of-bounds write in HCL Domino CVSS 3.1CRITICAL 9.8
  • TI-2020-11154 Buffer overflow in HCL Domino CVSS 3.1CRITICAL 9.8
  • TI-2024-15591 HCL Domino is susceptible to an information disclosure vulnerability CVSS 3.1HIGH 7.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences