HCL Launch up to 7.0.5.24/7.1.2.20/7.2.3.13 HTTP Request log file

Summaryinfo

A vulnerability identified as problematic has been detected in HCL Launch up to 7.0.5.24/7.1.2.20/7.2.3.13. This vulnerability affects unknown code of the component HTTP Request Handler. This manipulation causes log file. This vulnerability is handled as CVE-2024-42196. It is possible to launch the attack on the local host. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic was found in HCL Launch up to 7.0.5.24/7.1.2.20/7.2.3.13. Affected by this vulnerability is some unknown functionality of the component HTTP Request Handler. The manipulation with an unknown input leads to a log file vulnerability. The CWE definition for the vulnerability is CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. As an impact it is known to affect confidentiality. The summary by CVE is:

HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs.

It is possible to read the advisory at support.hcl-software.com. This vulnerability is known as CVE-2024-42196 since 07/29/2024. The exploitation appears to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• HCL

Name

• Launch

Version

• 7.0.5.0
• 7.0.5.1
• 7.0.5.2
• 7.0.5.3
• 7.0.5.4
• 7.0.5.5
• 7.0.5.6
• 7.0.5.7
• 7.0.5.8
• 7.0.5.9
• 7.0.5.10
• 7.0.5.11
• 7.0.5.12
• 7.0.5.13
• 7.0.5.14
• 7.0.5.15
• 7.0.5.16
• 7.0.5.17
• 7.0.5.18
• 7.0.5.19
• 7.0.5.20
• 7.0.5.21
• 7.0.5.22
• 7.0.5.23
• 7.0.5.24
• 7.1.2.0
• 7.1.2.1
• 7.1.2.2
• 7.1.2.3
• 7.1.2.4
• 7.1.2.5
• 7.1.2.6
• 7.1.2.7
• 7.1.2.8
• 7.1.2.9
• 7.1.2.10
• 7.1.2.11
• 7.1.2.12
• 7.1.2.13
• 7.1.2.14
• 7.1.2.15
• 7.1.2.16
• 7.1.2.17
• 7.1.2.18
• 7.1.2.19
• 7.1.2.20
• 7.2.3.0
• 7.2.3.1
• 7.2.3.2
• 7.2.3.3
• 7.2.3.4
• 7.2.3.5
• 7.2.3.6
• 7.2.3.7
• 7.2.3.8
• 7.2.3.9
• 7.2.3.10
• 7.2.3.11
• 7.2.3.12
• 7.2.3.13

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion