CVE-2026-21783

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21783", "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "state": "PUBLISHED", "assignerShortName": "HCL", "dateReserved": "2026-01-05T16:08:02.276Z", "datePublished": "2026-03-24T19:48:39.079Z", "dateUpdated": "2026-03-24T20:31:43.245Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL", "dateUpdated": "2026-03-24T19:48:39.079Z"}, "title": "HCL Traveler is affected by sensitive information disclosure", "datePublic": "2026-03-24T07:49:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-209", "description": "CWE-209 Generation of error message containing sensitive information", "type": "CWE"}]}], "affected": [{"vendor": "HCLSoftware", "product": "Traveler", "versions": [{"status": "affected", "version": "< 14.5.1.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "HCL Traveler is affected by sensitive information disclosure.\u00a0 The application generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces.\u00a0 Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "HCL Traveler is affected by sensitive information disclosure.&nbsp; The application generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces.&nbsp; Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.&nbsp;"}]}], "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129139"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T20:31:33.182400Z", "id": "CVE-2026-21783", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T20:31:43.245Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21783", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T20:31:33.182400Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T20:31:37.246Z"}}], "cna": {"title": "HCL Traveler is affected by sensitive information disclosure", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "HCLSoftware", "product": "Traveler", "versions": [{"status": "affected", "version": "< 14.5.1.0"}], "defaultStatus": "unaffected"}], "datePublic": "2026-03-24T07:49:00.000Z", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129139"}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "HCL Traveler is affected by sensitive information disclosure.\u00a0 The application generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces.\u00a0 Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.", "supportingMedia": [{"type": "text/html", "value": "HCL Traveler is affected by sensitive information disclosure.&nbsp; The application generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces.&nbsp; Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.&nbsp;", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-209", "description": "CWE-209 Generation of error message containing sensitive information"}]}], "providerMetadata": {"orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL", "dateUpdated": "2026-03-24T19:48:39.079Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21783", "state": "PUBLISHED", "dateUpdated": "2026-03-24T20:31:43.245Z", "dateReserved": "2026-01-05T16:08:02.276Z", "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "datePublished": "2026-03-24T19:48:39.079Z", "assignerShortName": "HCL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Traveler", "vendor": "HCLSoftware", "versions": [{"status": "affected", "version": "< 14.5.1.0"}]}], "source": "psirt@hcl.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:traveler:*:*:*:*:*:*:*:*", "matchCriteriaId": "2322008C-F1C9-4A93-913E-34478A2AA771", "versionEndExcluding": "14.5.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HCL Traveler is affected by sensitive information disclosure.\u00a0 The application generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces.\u00a0 Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks."}, {"lang": "es", "value": "HCL Traveler se ve afectado por una revelaci\u00f3n de informaci\u00f3n sensible. La aplicaci\u00f3n genera algunos mensajes de error que proporcionan informaci\u00f3n detallada sobre errores y fallos, como rutas internas, nombres de archivo, tokens sensibles, credenciales, c\u00f3digos de error o trazas de pila. Los atacantes podr\u00edan explotar esta informaci\u00f3n para obtener informaci\u00f3n sobre la arquitectura del sistema y potencialmente lanzar ataques dirigidos."}], "id": "CVE-2026-21783", "lastModified": "2026-06-17T10:19:00.390", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "psirt@hcl.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21783", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T20:31:33.182400Z", "version": "2.0.3"}}]}, "published": "2026-03-24T20:16:26.093", "references": [{"source": "psirt@hcl.com", "tags": ["Vendor Advisory"], "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129139"}], "sourceIdentifier": "psirt@hcl.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-209"}], "source": "psirt@hcl.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,14.5.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Traveler", "source": "cna", "vendor": "HCLSoftware"}, "product": "traveler", "vendor": "hcltech"}], "analysis": {"en": {"generated_at": "2026-04-01T05:49:36.749158+00:00", "value": {"mitigation_remediation": ["Check for a vendor\u2011supplied patch or security fix for HCL Traveler and apply it if available.", "Disable or suppress detailed error messages in HCL Traveler\u2019s configuration to ensure only generic error responses are returned.", "Restrict access to error logs and trace files so that only authorized personnel can view them.", "Monitor application logs for suspicious error patterns that may indicate an attempt to exploit the data disclosure vulnerability."], "summary": {"action": "Apply patch", "impact": "Sensitive Information Disclosure"}, "threat_synthesis": {"affected_systems": "Affected systems include HCL Traveler from HCLSoftware. No specific version information is provided in the available data, so all current installations of HCL Traveler are considered at risk until a patch or mitigation is applied.", "description_and_impact": "The vulnerability allows an attacker to obtain sensitive information through error messages that include internal paths, file names, tokens, credentials, error codes, and stack traces. This can expose the system\u2019s architecture and provide an attacker with valuable information for planning further attacks. The weakness is classified as CWE-209, which involves the accidental display of sensitive data in an error condition.", "risk_and_exploitability": "The CVSS score of 4.3 indicates low to medium severity, and the EPSS score is under 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, which further suggests it is not actively exploited by major threat actors. The most probable attack vector is through the application\u2019s web interface, where error responses are returned to the client. If an attacker can trigger specific errors, they may receive detailed messages. As no direct exploitation is provided, the risk remains primarily informational."}}}}, "created": "2026-03-25T11:46:10.383975+00:00", "updated": "2026-04-02T07:59:23.380688+00:00", "vendors": ["hcltech", "hcltech$PRODUCT$traveler"]}