Security readout for executives and security teams
Plain-English summary
HCL Domino versions 9, 10, and 11 have an access-control flaw. A logged-in attacker with local system access could gain higher privileges, disrupt service, or access information. The provided sources do not describe remote exploitation.
Executive priority
Treat as high priority for Domino environments because a local authenticated compromise could become full system-impacting access. Prioritize systems with shared administration, exposed remote access paths, or sensitive mail and application data.
Technical view
CVE-2020-4107 is CWE-284 insufficient access control in HCL Domino 9, 10, and 11. CVSS 3.1 is 8.8 with local attack vector, low complexity, low privileges, no user interaction, changed scope, and high confidentiality, integrity, and availability impact.
Likely exposure
Organizations running HCL Domino versions 9, 10, or 11 are potentially exposed, especially where users or service accounts have local access to Domino hosts.
Exploitation context
The source bundle does not show CISA KEV listing or public active exploitation evidence. Exploitation requires authentication and local access, which reduces internet-scale risk but raises insider, compromised-account, and shared-host risk.
Researcher notes
Evidence is limited to CVE metadata and the linked HCL advisory. The bundle lists affected major versions but no CPEs, no exploit details, and no explicit patch version text, so remediation should follow current HCL guidance.
Mitigation direction
- Identify all HCL Domino 9, 10, and 11 deployments.
- Review HCL advisory KB0090221 for vendor-supported fixes or workarounds.
- Limit local interactive access to Domino servers to required administrators.
- Audit service accounts and remove unnecessary local privileges.
- Increase monitoring for unexpected privilege, service, or file-access events.
Validation and detection
- Confirm installed Domino versions across production, staging, and legacy hosts.
- Check whether each affected host has applied HCL-recommended remediation.
- Review who has local access to Domino server operating systems.
- Verify logging covers privilege changes, service failures, and sensitive file access.
- Document residual exposure where vendor guidance cannot be applied immediately.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-4107 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0090221CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.