HCL DevOps Deploy and HCL Launch Insufficient Session Expiration Vulnerability Allowing Unauthorized Access

A race condition has been identified in the http-session client-IP binding enforcement of HCL DevOps Deploy versions 8.0 prior to 8.0.1.10 and 8.1 prior to 8.1.2.3, as well as HCL Launch versions 7.3 through 7.3.2.15. This vulnerability creates an insufficient session expiration issue, allowing a session to be temporarily reused from a different IP address before it is properly invalidated. Under certain network conditions, this could result in unauthorized access.

Impact

Exploitation of this vulnerability could lead to unauthorized access by allowing sessions to be reused from different IP addresses.

Remediation

Users are advised to upgrade to HCL Launch versions 7.3.2.16 or later, or HCL DevOps Deploy versions 8.0.1.11, 8.1.2.4, 8.2.0.0 or later.