CVEvulnerability

CVE-2026-21766

5.4 MEDIUM Published 2026-08-05 Modified 2026-10-23 Official page ↗
Status
Deferred
Published
2026-08-05
Last modified
2026-10-23
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
Weaknesses
CWE-522, CWE-532

Description

The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials.  Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs.  This only affects applications using the default login portlet.

Related

Weakness · CWE (2)

  • CWE-522 Insufficiently Protected Credentials weakness
  • CWE-532 Insertion of Sensitive Information into Log File weakness

References