HCL Digital Experience vulnerabilities

The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under very specific use cases and configurations, sensitive information may be written to web server logs. This only affects applications using the default login portlet.

HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker can execute arbitrary operating system commands, inheriting the privileges of the vulnerable application, potentially leading to a complete system takeover and data compromise.

HCL Digital Experience and HCL Digital Experience Compose are susceptible to Host header injection. An attacker can manipulate the Host header, causing the application to behave unexpectedly.