Security readout for executives and security teams
Plain-English summary
HCL Launch can store user credentials in clear text. A user with local or high-privilege access could read those secrets, creating risk of credential reuse, unauthorized deployments, or lateral movement. The public bundle identifies specific affected versions but does not provide detailed remediation text.
Executive priority
Prioritize this for environments where HCL Launch controls sensitive deployments or stores reusable credentials. It is not rated critical, but exposed credentials can turn a limited access issue into broader operational compromise.
Technical view
CVE-2022-27548 is an HCL Launch information disclosure issue mapped to CWE-256. The affected versions listed are 7.2.2.1, 7.1.2.6, and 7.0.5.10. CVSS 3.1 is 4.9, with high confidentiality impact and no integrity or availability impact.
Likely exposure
Exposure is most likely on HCL Launch servers running the listed versions where local users or highly privileged accounts can access stored credential material. Internet exposure is not established by the supplied sources.
Exploitation context
The source bundle does not show CISA KEV listing or cited active exploitation. The CVSS vector indicates low attack complexity but high privileges are required. Treat this primarily as a credential exposure and insider or post-compromise risk.
Researcher notes
Evidence is limited to CVE metadata and an HCL support reference. The bundle does not name exploit activity, proof-of-concept availability, exact file paths, or fixed releases. Avoid assuming broader product impact beyond the listed HCL Launch versions.
Mitigation direction
- Review HCL advisory KB0099253 for vendor-approved remediation and fixed-version guidance.
- Inventory HCL Launch deployments for versions 7.2.2.1, 7.1.2.6, and 7.0.5.10.
- Restrict local and administrative access to HCL Launch hosts to trusted personnel only.
- Rotate credentials that may have been stored by affected HCL Launch instances.
- Monitor vendor guidance before applying unsupported configuration changes.
Validation and detection
- Confirm installed HCL Launch versions across production, staging, and disaster recovery environments.
- Review host access controls for users able to read HCL Launch files.
- Check whether stored credentials are present in clear text on affected systems.
- Review access logs for unusual local or privileged account activity.
- Verify credential rotation after vendor-approved remediation is complete.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-256: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-27548 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N1.23.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.9MediumVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0099253CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.