Anyone who relies on the groupware software HCL Notes when processing projects should update it due to a recently discovered security gap. The web client iNotes is also vulnerable.

DoS, malicious code, XSS HCL Notes is closely linked to an e-mail link. A vulnerability (CVE – 2020 – 14224) concerns the handling of MIME mails. A remote attacker could use a specially prepared message to provoke a buffer overflow. That ends in a crash (DoS). Under certain circumstances, even executing malicious code with the rights of the victim is conceivable, warn the developers in an article.

The vulnerability is related to the threat level ” high “classified. Only version 9 is affected. Admins should contact HCL support for a repaired version.

The second vulnerability (CVE – 2020 – 14271) applies to the iNotes web client. If an attacker successfully tackles the vulnerability, he could carry out an XSS attack and push his own code into a web browser. The iNotes issues 9, 10 and 11 are vulnerable. The developers have the weaknesses in the versions 10. 0.1 FP6 and 11. 0.1 FP2 closed. The gap is also classified as ” high “.

(of)