CVE-2021-23450 – Is Dojo 1.9.7 patched in HCL DX 9.5 CF217?

HCL Digital Experience Digital Experience Forum
1

Please complete the details below then remove this line:

Hello HCL Community,

We are running HCL Digital Experience 9.5 with Cumulative Fix CF217 in our production environment.

Our BitSight security scanner has detected Dojo 1.9.7 and reports the following vulnerabilities:

  • CVE-2018-15494
  • CVE-2020-5258
  • CVE-2021-23450

We understand that HCL has already addressed some Dojo vulnerabilities through previous cumulative fixes.

Could someone from HCL confirm whether CVE-2021-23450 is fixed or backported in CF217?

If so, is there an official security bulletin, APAR or other documentation confirming this?

If CF217 is still affected, is there a supported workaround or mitigation?

We need this information to clarify an outstanding security finding with our internal security team.

Thank you for your help!

2

Hi cspallek,

I would recommend using our HCL Doc IQ tool (click on the icon in lower right of the page) and try to search for the CVEs.

I did also do a quick check on the CVEs. For CVE-2018-15494, and there is an article (KB0124746) that talks about it (fixed in CF221). For the other 2, it may require a case as I don’t see any mentions of those.

Hope this helps,

DX L2 team

3

Hi,

Thank you for your help and for pointing me in the right direction!

I found the relevant information in the official HCL Cumulative Fix list. All three reported Dojo vulnerabilities have already been addressed in earlier Cumulative Fixes and are therefore included in our installed CF217.

Here is the official HCL documentation:

Thanks again for your support!

Best regards,
Cengiz