Read the docs
TI-2023-19123 Aliases CVE-2023-37524GHSA-vp5c-23j8-3fh2

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET…

Priority LOW 36CWE-1104Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service.  Since .NET Framework 4.5 has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses through vulnerable third-party components.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00273 19th percentileScored 2026-11-07
Fix Fixed Traveler for Microsoft Outlook (HCLSoftware): 3.0.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HCL SoftwareTraveler for Microsoft Outlookbefore 3.0.63.0.6Patch availableCNA
  • Traveler for Microsoft Outlook VendorHCL Software Affected before 3.0.6 Fixed in 3.0.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hcltech:traveler_for_microsoft_outlook:*:*:*:*:*:*:*:*before 3.0.6VulnerableHCL Software
  • cpe:2.3:a:hcltech:traveler_for_microsoft_outlook:*:*:*:*:*:*:*:* Versions before 3.0.6 Vulnerable ·HCL Software

Remediation

  • Fix · CNA Traveler for Microsoft Outlook (HCLSoftware) Fixed in 3.0.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-37524
  2. 2026-10-03 Alias added: GHSA-vp5c-23j8-3fh2

References

Advisory 1

  • TI-2024-28194 HCL Traveler for Microsoft Outlook (HTMO) is susceptible to COM hijacking CVSS 3.1CRITICAL 9.8
  • TI-2024-28193 HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking CVSS 3.1CRITICAL 9.8
  • TI-2024-15610 HCL Traveler for Microsoft Outlook (HTMO) is susceptible to an application modification vulnerability CVSS 3.1HIGH 7.8
  • TI-2024-19891 HCL Traveler for Microsoft Outlook (HTMO) is susceptible to an application modification vulnerability CVSS 3.1HIGH 7.5
  • TI-2025-37291 HCL Traveler for Microsoft Outlook (HTMO) is susceptible to sensitive data exposure CVSS 3.1MEDIUM 5.5
  • TI-2024-28195 Insufficiently protected credentials in HCL Software Traveler for Microsoft Outlook CVSS 3.1MEDIUM 5.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences